🔍 Read the full analysis: Dutch Government Websites Go Offline Amid PHP2Shell And Critical PHP Flaws on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October 2026 as a precaution after PHP disclosed two critical vulnerabilities. Officials said there were no signs of active exploitation of the services at the time of their announcement; attack attempts reported by Cloudflare do not establish that those government sites were breached. PHP has released fixes, and the Dutch cybersecurity authority urges organizations to patch affected systems or keep them offline.
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP disclosed two critical flaws that can allow attackers to execute code remotely without logging in. The government said it had no signs of active exploitation at the time of its announcement; the shutdown was preventive and does not confirm that those services were compromised.
PHP’s security team assigned the flaws identifiers CVE-2026-109618 and CVE-2026-109619 and gave each a CVSS v4.0 score of 9.2, rated Critical. Both involve failures in how PHP handles memory or internal state while processing requests. Under certain conditions, those errors can produce memory corruption or use-after-free behavior that may enable remote code execution.
The advisories identify PHP installations handling web requests as potentially affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP reported demonstrated exploitation on Apache with mod_php. Its advisory on the out-of-memory flaw says code execution would run as the web worker account; that does not by itself establish access to administrator or root privileges. Research described by Calif also identifies application-dependent exploitation paths involving PHP-FPM, so differences in configuration do not establish that a deployment is safe.
PHP published patched releases on 21 October: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, though the source material says PHP provided minimal source backports for versions 7.4, 8.0 and 8.1. Operators relying on distribution or extended-support packages need to confirm with their vendor that a fixed package is available. A version number alone may not reveal whether a vendor has applied a backport.
Cybersecurity · Public services · 21 October 2026
Dutch Government Websites Go Offline Amid PHP2Shell And Critical PHP Flaws
The Netherlands took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution after PHP disclosed two critical vulnerabilities. Officials reported no signs of active exploitation of those services when they announced the shutdown.
Flaws in the runtime beneath the site
The vulnerabilities affect PHP while it processes web requests. Updating a CMS, theme or plugin alone does not patch PHP itself.
Memory handling flaw
Under certain conditions, an out-of-memory error can cause unsafe behavior and potentially enable remote code execution. PHP says demonstrated exploitation ran as the web worker account; this does not by itself mean administrator or root access.
Internal state flaw
A use-after-free condition can corrupt memory and may allow an unauthenticated attacker to execute code remotely when a vulnerable PHP runtime handles a request.
Multiple PHP setups
Advisories cover PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Configuration differences do not prove a deployment is safe.
From disclosure to service checks
The government has not provided a return-to-service timetable in the available statements.
21 October
Dutch services taken offline as a precaution. Officials report no signs of active exploitation at announcement time.
PHP fixes
Patched releases published: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Authority guidance
The Dutch National Cyber Security Centre urges organizations to patch or keep unupdated systems offline.
Restore only after checks
Operators need to verify the fixed runtime is serving live requests before restoring exposed services.
What the reports do—and do not—show
Keep the claims tied to their sources and timing. Attack attempts are not proof of successful access.
“There were no signs of active exploitation at the time of the announcement.”
Dutch government announcement
Patch the runtime, then verify it
Application updates are not a substitute for fixing the PHP runtime that handles requests.
Why PHP Runtime Patching Matters
The flaws affect the PHP runtime beneath website applications, so updating a content management system, theme or plugin is not a substitute for patching PHP itself. Cloudflare’s guidance specifically warns that application-code updates alone do not resolve these vulnerabilities. For organizations using managed hosting, the immediate question is whether the provider has patched the PHP runtime actually serving each site.
Unauthenticated remote code execution can put a web server at risk without an attacker first obtaining a legitimate account. Wiz reported demonstrations against WordPress, Drupal and Joomla deployments, but those examples do not mean the CMS products themselves contain these flaws: the issue is in PHP. Wiz also described sensitive process-memory disclosure that could expose credentials or tokens without achieving code execution. These are reported research demonstrations, not evidence that every vulnerable site has been attacked.
The shutdowns show how a software flaw can affect access to public services even when a breach has not been confirmed. Keeping a site offline can limit exposure while an operator assesses and patches it, but it can also interrupt access for residents and businesses. The Dutch National Cyber Security Centre says systems that have not been updated should remain offline as a precaution, placing the burden on operators to verify both the fix and the runtime in use before restoring service.
PHP security patch for web servers
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Dutch Shutdown and PHP Fix Timeline
In its 21 October announcement, the Dutch government said several services were taken offline as a precaution and reported no signs of active exploitation at that time. It also said many government websites, including Rijksoverheid.nl, do not use PHP and were not affected by these particular flaws. The announcement distinguishes the services temporarily taken offline from other government sites that were not exposed to this PHP issue.
The Dutch National Cyber Security Centre later confirmed that patches were available and urged organizations to apply them. Separately, Cloudflare reported seeing attack traffic and attempts to alter payloads to bypass its protections. That provider’s observations indicate attempts to exploit the flaws; they do not establish a breach of Overheid.nl, MijnOverheid.nl or DigiD.
The disclosure also involved security research using AI tools, but the accounts describe different contributions. OpenAI said Calif identified a critical flaw through its Patch the Planet initiative, while Wiz said it independently discovered and reported both vulnerabilities. PHP’s maintainers led the fixes. Calif said its work used generally available models and emphasized the researcher’s direction and knowledge of PHP’s history; these accounts do not establish that AI tools independently found or fixed the flaws.
“There were no signs of active exploitation at the time of the announcement.”
— Dutch government announcement
web application vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Breach Status and Exposure Checks
The available statements do not say when the Dutch services will return or provide a technical account of whether their PHP runtimes were vulnerable before being taken offline. The government said it had no signs of active exploitation when it announced the precautionary action, but that is a time-specific assessment, not proof that no attempted access occurred at any point.
Cloudflare’s observations concern attack attempts, not confirmed access to the named public services. The source material does not establish which attackers were involved, how many systems were targeted, or whether any other organizations suffered a confirmed compromise. It also does not list each affected Dutch service’s exact PHP version or configuration.
For organizations using hosting providers or vendor-maintained packages, it remains necessary to confirm which runtime is serving each site and whether a fixed build has been installed. PHP-FPM and other configurations can differ in their exposure, but the reported differences do not establish blanket protection. Vendors’ backports may also mean an older-looking version string does not, on its own, show whether a fix is present.
As an affiliate, we earn on qualifying purchases.
Patch Verification Before Services Return
Organizations should identify where affected PHP versions are running, apply the appropriate fixed release or vendor package, and verify that the patched runtime is the one handling live requests. For managed hosting, operators will need confirmation from their provider rather than relying on updates to their website dashboard or application code. The Dutch cyber authority’s published guidance is to keep unpatched systems offline.
The Dutch government has not stated a return-to-service timetable in the material available here. Further updates are needed on when the affected websites will reopen and what checks will precede restoration. Operators should also watch for updates from PHP and their package vendors, particularly if they depend on extended-support versions or distribution backports.
web server security hardening tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Were the Dutch government websites confirmed to be hacked?
No compromise was confirmed in the government’s announcement. It said there were no signs of active exploitation at that time and described taking services offline as a precaution. Cloudflare’s report of attack attempts does not establish that these government sites were breached.
Which PHP versions include the fixes?
PHP listed 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as releases containing the fixes on 21 October 2026. PHP also provided minimal source backports for 7.4, 8.0 and 8.1, according to the source material. Organizations using vendor packages should confirm directly that their package includes the fix.
Does updating WordPress or another CMS fix PHP2Shell?
No. The flaws are in the PHP runtime, below the website application. Updating WordPress, Drupal, Joomla, plugins or themes alone does not patch PHP; the runtime serving the site must be updated.
Are all PHP websites vulnerable?
The advisories identify several PHP configurations handling web requests as potentially affected, but exposure depends on the runtime, version and deployment. The available material does not establish that every PHP website is vulnerable or that a particular configuration is automatically safe.
When will the Dutch services be back online?
No restoration timetable is provided in the source material. The Dutch authorities say unpatched systems should remain offline as a precaution; the government has not stated here when the affected services will reopen.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
