🔍 Read the full analysis: Dutch Government Sites Go Offline Amid Scrutiny Of PHP2Shell And PHP Flaws on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on Oct. 21 as a precaution over two critical PHP vulnerabilities known as PHP2Shell. PHP released security updates the same day, and authorities urged organizations to patch; the shutdown announcement reported no signs of active exploitation of the affected Dutch services.
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on Oct. 21 as a precaution after two critical vulnerabilities in PHP, the software used to run websites, were disclosed. PHP released fixes for the flaws, known collectively as PHP2Shell, the same day; the government said it had no signs of active exploitation at the time of its announcement, and did not report that those services had been compromised.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories say both can lead to remote code execution without a login. Each carries a CVSS v4.0 score of 9.2, classified as critical. The flaws affect PHP installations that handle web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP published patched releases for its supported branches on Oct. 21: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations on older branches or using distribution and extended-support packages need to check with their supplier for a fixed version. PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1, but an older version number by itself does not show whether a vendor has applied a backport.
The Dutch National Cyber Security Centre subsequently said patches were available and urged organizations to update. Its guidance says systems that remain unpatched should stay offline as a precaution. The government also said many sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
Cybersecurity · Public Services · October 21, 2026
Dutch Government Sites Go Offline Amid Scrutiny of PHP2Shell
Three public services were taken offline as a precaution after two critical PHP flaws were disclosed. Patches arrived the same day; officials reported no signs of active exploitation of the named Dutch services when they announced the shutdown.
01 / The response
A precaution, with patches available
The shutdown centered attention on the runtime beneath websites: the PHP software that processes requests, rather than the content or plugins managed by a site owner.
Three services named
Overheid.nl, MijnOverheid.nl and DigiD were taken offline while security checks proceeded. No restoration schedule was provided in the source material.
PHP-dependent systems
The flaws affect PHP installations handling web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Many sites use no PHP
The government said many websites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific vulnerabilities.
Updating WordPress, Drupal, Joomla or their plugins alone does not patch PHP. Verify the runtime actually serving requests, including when hosting is managed by a provider.
02 / How the flaws work
Two memory-handling failures
PHP advisories describe both vulnerabilities as capable of remote code execution without a login. Actual exposure depends on runtime, configuration and, in some paths, the application.
Failure paths
What execution can mean
Research cited in the source material demonstrated unauthenticated code execution against WordPress, Drupal and Joomla deployments. These examples show the potential reach of a PHP runtime flaw; they are not separate vulnerabilities in those content management systems.
The PHP advisory says execution in the demonstrated out-of-memory case runs as the web worker account. That does not automatically grant administrator or root privileges.
Research demonstrated exploitation on Apache with mod_php. PHP-FPM handles some startup failures differently, while application-dependent paths have also been described.
Cloudflare reported attack traffic and payload changes aimed at bypassing protections. This does not prove the named Dutch services were targeted or breached.
The source credits Calif through OpenAI’s Patch the Planet initiative and independent discovery by Wiz. PHP maintainers issued the fixes.
03 / Patch status
Fixed releases for supported branches
PHP published updates on October 21, 2026. For older branches and distribution or extended-support packages, confirm the fixed package with the vendor.
Minimal source backports were also provided for versions 7.4, 8.0 and 8.1. A version number alone may not reveal whether a vendor applied a backport; check the package advisory.
04 / Operator workflow
Patch, verify, then assess
The Dutch National Cyber Security Centre urged organizations to update. Systems that remain unpatched should stay offline as a precaution.
Identify the runtime
Confirm which PHP package and deployment model handles live requests.
Apply a verified fix
Install a fixed release or a vendor package with a documented backport.
Check what is serving
Verify the patched runtime is active; do not rely only on a dashboard or plan.
Keep unpatched systems offline
Follow NCSC guidance until patching is complete, then assess exposure as needed.
05 / Evidence check
What is known — and what is not
Separating reported observations from open questions helps operators respond without treating every signal as proof of compromise.
| Question | Reported information | What remains unknown |
|---|---|---|
| Were the named Dutch services hacked? | No breach confirmed. The government said it had no signs of active exploitation when it announced the precautionary shutdown. | Whether any attempt succeeded, or whether an attempt occurred against those services. |
| Was attack activity observed? | Cloudflare reported attack traffic and payload modification attempts across its services. | That report does not establish the Dutch sites were targeted or compromised. |
| Are all PHP-FPM systems safe or vulnerable? | Exposure depends in part on runtime behavior, configuration and application paths. | A deployment label alone is not enough to classify an individual system. |
| When will services return? | Security checks and patching are the next stated milestones. | No restoration schedule was given in the source material. |
06 / Quick answers
Questions operators are asking
Which services were taken offline?
Overheid.nl, MijnOverheid.nl and DigiD were named. Many other government sites, including Rijksoverheid.nl, were said not to use PHP.
What needs updating?
The PHP runtime serving the website needs a fixed release or verified vendor package. CMS and plugin updates alone do not fix PHP runtime flaws.
Which fixes were listed?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on October 21, 2026. Check providers for vendor-supported branches and backports.
What is the immediate precaution?
Apply the patch and verify the live runtime. NCSC guidance says systems that remain unpatched should stay offline.
Source material: ThorstenMeyerAI.com
Why PHP Runtime Patching Matters
The incident puts a widely used layer of website infrastructure at the center of a public-service disruption. Because the flaws are in the PHP runtime, updating a website’s content management system or plugins alone does not fix them. Operators need to verify that the PHP version actually serving requests has been patched, including when hosting is managed by a third party.
Research cited in the source material demonstrated unauthenticated code execution against WordPress, Drupal and Joomla deployments. Those examples illustrate the potential effect of flaws in PHP itself; they do not mean that each content management system has a separate vulnerability. The PHP advisory says execution in the demonstrated out-of-memory case runs as the web worker account, which does not automatically confer administrator or root privileges.
Cloudflare reported seeing attack traffic and attempts to modify payloads to bypass protections. That adds urgency to patching, but it is not evidence that the named Dutch government services were breached. Keeping the distinction clear matters for public confidence and for organizations deciding whether to patch, isolate or investigate their own systems.
As an affiliate, we earn on qualifying purchases.
How the PHP2Shell Flaws Work
Both flaws involve PHP’s handling of internal memory and request state when processing is interrupted. In CVE-2026-109618, an out-of-memory failure can interrupt an operation before request data is fully initialized; subsequent cleanup may handle invalid data as if it were valid. In CVE-2026-109619, internal state can retain references to request memory after that memory has been freed, creating a use-after-free condition.
The source material says PHP reported demonstrated exploitation on Apache with mod_php. It also cautions against treating one deployment model as universally safe: PHP-FPM handles some startup failures differently, while technical research describes application-dependent exploitation paths involving PHP-FPM. Exposure therefore depends in part on the runtime, configuration and application.
The disclosure involved several research groups and tools. The source says OpenAI attributed one discovery to Calif through its Patch the Planet initiative, while Wiz independently discovered and reported both flaws. PHP maintainers issued the fixes. The accounts describe AI tools as part of researcher-led work, not as a substitute for expert investigation.
As an affiliate, we earn on qualifying purchases.
What Is Known About Exposure
The available information does not say whether any PHP2Shell attempt succeeded against Dutch government systems, or whether the services were later restored. The government’s statement said it had no signs of active exploitation when issued, but that is not the same as proof that no attempt occurred or that every system was unaffected.
Cloudflare’s report of attack traffic concerns activity it observed across its services; it does not establish that the Dutch sites named in the announcement were targeted or compromised. Nor does the source material identify every affected government system, the complete set of organizations exposed, or the exact configuration of each service.
PHP-FPM and other deployment setups also cannot be classified as safe or vulnerable based only on their names. The described paths depend on configuration and, in some cases, the application. Operators need to consult vendor advisories and confirm the package installed on the system handling live requests.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Organizations running PHP should apply the fixed release for their branch, or obtain a verified vendor package where updates are supplied through a distribution or hosting provider. They should then check that the patched runtime is the one serving their websites, rather than relying on a software dashboard or a stated update plan. For affected systems that cannot yet be patched, the Dutch NCSC guidance is to keep them offline.
The next public milestone for the Dutch services is confirmation of their security checks and restoration, but the source material gives no restoration schedule. Hosting providers and government operators may also issue service-specific updates. Until then, whether individual sites were exposed or require further investigation remains a matter for their operators to establish.
cybersecurity vulnerability management
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Were the Dutch government websites confirmed to be hacked?
No. The government took several sites offline as a precaution and said it had no signs of active exploitation at the time of its announcement. The source material does not confirm a breach of those services.
Which services were taken offline?
The announcement named Overheid.nl, MijnOverheid.nl and DigiD. It also said many other government sites, including Rijksoverheid.nl, did not use PHP and were unaffected by these particular flaws.
What should a website operator update?
Operators need to patch the PHP runtime serving the site, using a fixed release or a verified vendor package. Updating WordPress, Drupal, Joomla or plugins alone does not address vulnerabilities in PHP itself.
Which PHP releases include the fixes?
The source lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on Oct. 21, 2026. Organizations on older or vendor-supported branches should check with their provider because backported fixes may not be apparent from the version number alone.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
