TL;DR
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
PHP released emergency updates on Oct. 21, 2026, for two critical vulnerabilities that can allow unauthenticated remote code execution. The Dutch government said it took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; it did not report confirmed compromises of those services.
PHP released emergency security updates on Oct. 21 for two critical flaws that can allow attackers to run code remotely without logging in. On the same day, the Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement did not say those services had been compromised.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell, affect PHP installations that handle web requests. PHP’s security advisory lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the configurations at risk. Both flaws carry a CVSS v4.0 score of 9.2, rated Critical.
PHP attributes the first flaw to interrupted memory handling: an out-of-memory failure can leave request data partly initialized, and cleanup may then handle invalid data as though it were valid. The second involves internal state retaining references to memory that has already been freed, allowing a later request handled by the same worker to encounter stale data. Each condition can lead to memory corruption and code execution, according to the advisories.
Fixes were released for PHP branches 8.5, 8.4, 8.3 and 8.2 as versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for 7.4, 8.0 and 8.1, which are outside normal upstream support. Operators using older or vendor-maintained packages need to check with their provider: an older version number alone may not show whether a backported fix is present.
Security briefing · 21 October 2026
Critical PHP Flaws, PHP2Shell, and Offline Dutch Government Websites
Emergency PHP updates address two critical flaws that can enable remote code execution without login. Dutch authorities took several services offline as a precaution; the available announcement did not report confirmed compromises.
01 / The vulnerabilities
Memory handling sits at the center
PHP says both flaws can cause memory corruption and code execution under affected conditions. Exposure depends on the deployment and attack path.
Interrupted memory handling
An out-of-memory failure can leave request data partly initialized. Cleanup may then treat invalid data as valid, creating a path to memory corruption and possible remote code execution.
Stale internal references
Internal state can retain references to memory that has already been freed. A later request handled by the same worker may encounter stale data and trigger memory corruption.
02 / Where to look
Check the runtime serving web requests
The advisory lists several PHP configurations. A critical score signals severity; it does not mean every installation is exploitable in the same way.
Apache + mod_php
PHP reports demonstrated exploitation on this configuration. Confirm which package and runtime serve each site.
PHP-FPM & php-cgi
Inventory pools, virtual hosts, and web-facing workers across production, staging, and legacy applications.
FrankenPHP & LiteSpeed
These are also listed among configurations at risk. Check the PHP advisory and provider guidance for your setup.
03 / Fixed releases
Update PHP itself
A CMS, theme, or plugin update does not patch the PHP engine. Apply a fixed runtime package and activate it with the required restart or redeployment.
Upstream fixes released October 21
PHP also provided minimal source backports for 7.4, 8.0, and 8.1, which are outside normal upstream support. For vendor-maintained packages, ask whether both CVEs are covered; an older version string alone may not reveal a backport.
04 / Operator response
Patch, activate, investigate
Cover every web-facing deployment, including environments where the command-line PHP version differs from the runtime that handles requests.
Inventory
Find PHP versions, packages, pools, and applications across production, staging, and older systems.
Patch
Install a fixed release or a vendor package confirmed to address both vulnerabilities.
Activate
Restart or redeploy as needed, then verify web requests reach the patched runtime.
Review
Preserve relevant logs and investigate anomalies. A patch does not rule out earlier intrusion.
05 / Service status
Offline as a precaution
The available source material describes a preventive response and does not establish whether the named Dutch services were compromised.
Three named services taken offline
Overheid.nl, MijnOverheid.nl, and DigiD were taken offline on October 21 as a precaution. The source gives no restoration timetable or further investigation findings.
No confirmed breach reported
Cloudflare separately reported attack attempts against its customers. That activity does not establish successful exploitation at any named Dutch government service.
06 / Key questions
What the response means
Were the Dutch government websites hacked?
The source says the services were taken offline as a precaution. It does not report confirmed compromise of those sites.
Does updating WordPress fix these flaws?
No. The vulnerabilities affect the PHP engine. Updating WordPress, a theme, or a plugin does not patch the runtime.
Does a 9.2 score mean every setup is exploitable?
No. The score describes severity. Exposure depends on deployment and configuration; consult the advisory and provider for specific guidance.
What if immediate patching is not possible?
Ask the provider about limiting access or temporarily taking an affected service offline. Firewalls can add protection but do not replace an update.
Patching the Web Runtime
The flaws put the PHP runtime itself at the center of response efforts. Updating a site’s content management system, themes or plugins does not patch the PHP engine. Operators need to identify which PHP version actually serves web requests, apply a fixed release or vendor package, and complete any restart or redeployment needed to activate it.
That inventory can be more complicated than checking a single server. Organizations may have separate production, staging and legacy applications, and the PHP used by a command-line tool may differ from the web runtime. The risk also depends on deployment and configuration. PHP reports demonstrated exploitation on Apache with mod_php, while other paths may depend on the application. A critical score describes severity; it does not establish that every installation is exploitable in the same way.
PHP says demonstrated code execution runs with the privileges of the web worker. That can give an attacker access to resources available to the web service, but it does not by itself mean administrator or root access. Operators should investigate suspicious activity as well as patch: installing a fix does not remove an intrusion that may have happened beforehand. Relevant logs should be preserved for review.
As an affiliate, we earn on qualifying purchases.
Dutch Shutdowns as Precaution
The Dutch government said several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline on Oct. 21 as a preventive measure. Those services support access to government information and public services, so their temporary unavailability affected more than routine website traffic. The government’s statement, as described in the source material, announced precautionary shutdowns rather than confirmed breaches.
Cloudflare separately reported attack attempts against its customers. That report indicates activity related to the vulnerabilities, but it does not establish that a named Dutch government service was successfully attacked. The available source material does not specify how long the Dutch websites remained offline or when each service would return.
The disclosures also describe AI-assisted research by Calif, OpenAI and Wiz, with tools including GPT-5.6 Sol and Gemini 4 Argon. The source attributes discovery work to those researchers, while PHP maintainers led the fixes and releases. AI involvement is part of the account of how the flaws were found; it does not change the immediate requirement for operators to patch affected runtimes.
“Both vulnerabilities are rated 9.2 Critical under CVSS v4.0.”
— PHP security advisory
As an affiliate, we earn on qualifying purchases.
Exposure and Service Status
The source material does not establish whether any Dutch government website was compromised, or whether attackers successfully exploited either flaw against a particular service. Cloudflare’s report of attack attempts against its customers is not evidence of a successful intrusion at the named government sites.
Exposure varies by deployment, and the advisories do not make every listed PHP setup equally vulnerable in practice. The material also does not give a complete account of the configuration or application requirements for each attack path. Operators should consult the PHP advisory and their hosting or package provider for guidance that matches their environment.
The source does not give a restoration timetable for the Dutch websites, nor does it say whether the government found evidence of access during its response. The status of any investigation, and whether further shutdowns or service disruptions followed, remains unclear from the material available here.
As an affiliate, we earn on qualifying purchases.
Runtime Updates and Reopening
Website operators should identify every web-facing PHP deployment, including staging and older applications, and update to a fixed release or a vendor package confirmed to address both CVEs. They should verify that web requests reach the patched runtime after any required restart or redeployment, then check that site functions work as expected. A managed-hosting customer can ask its provider to confirm which package is installed and whether both vulnerabilities are covered.
Operators who cannot patch immediately should consult their provider about limiting access or temporarily taking an affected service offline. Web application firewalls and other protections can add a layer of defense, but they are not substitutes for a security update. After patching, teams should review relevant logs and investigate anomalies, since a fix does not establish whether an earlier intrusion occurred.
The Dutch government will need to determine when affected services can safely return, but the source material gives no timetable or additional findings. PHP’s advisories and vendor notices are the primary references for release details; operators should check them for updates as the response develops.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are the PHP2Shell vulnerabilities?
They are two flaws, CVE-2026-109618 and CVE-2026-109619, involving PHP memory handling and internal state. The PHP advisories say either can lead to remote code execution without login under affected conditions.
Were the Dutch government websites hacked?
The source says the government took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution. It does not report confirmed compromise of those services.
Which PHP releases include the fixes?
The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1; operators should confirm with their vendor that any package includes both fixes.
Does updating WordPress fix the flaws?
No. These vulnerabilities affect the PHP engine, so updating WordPress, a theme or a plugin does not patch the runtime. The web-serving PHP installation needs a fixed release or confirmed vendor package.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
