TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Dutch government websites were temporarily taken offline on October 21, 2026, as a precaution following the discovery of critical PHP vulnerabilities, known as PHP2Shell, which could allow remote code execution. The vulnerabilities have been patched in recent PHP updates, but the incident highlights ongoing security risks in PHP deployments.
Several Dutch government websites, including Overheid.nl, MijnOverheid.nl, and DigiD, were taken offline on October 21, 2026, as a precaution after the discovery of two critical PHP vulnerabilities that could enable remote code execution. The government emphasized these actions were preventive, not confirmed compromises, but the incident underscores the urgency of patching PHP vulnerabilities in public-facing systems.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are classified as critical with a CVSS v4.0 score of 9.2. They involve flaws in PHP’s memory management and internal state handling, which can be exploited to execute malicious code remotely without authentication. PHP’s security team issued emergency updates on October 21, releasing patched versions for PHP 8.2, 8.3, 8.4, and 8.5 branches. These patches address issues where interrupted memory handling and stale internal state could be exploited, especially in web server environments such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
According to PHP security advisories, the vulnerabilities are exploitable through specific deployment configurations, with demonstrated attacks on Apache with mod_php. The Dutch government responded by temporarily shutting down several key websites as a precaution, even though there is no confirmed evidence of breaches. Cloudflare also reported attack attempts targeting its customers during this period, indicating active exploitation attempts in the wild.
Implications of Critical PHP Flaws on Public Infrastructure
This incident highlights the ongoing risks posed by unpatched PHP vulnerabilities, especially in government and critical infrastructure websites. The vulnerabilities could allow attackers to execute malicious code, potentially leading to data breaches, service disruptions, or further exploitation. The Dutch government’s proactive shutdown underscores the importance of timely patching and vigilant security practices in web server environments handling sensitive data.
As an affiliate, we earn on qualifying purchases.
Background on PHP2Shell Vulnerabilities and Recent Security Updates
The PHP2Shell flaws, disclosed on October 21, 2026, are part of a broader category of security issues related to memory management and internal state handling in PHP. These vulnerabilities were discovered with the assistance of AI tools, including GPT-5.6 Sol and Gemini 4 Argon, which aided researchers in identifying the flaws. PHP’s security team responded swiftly, releasing patches for supported PHP branches, including PHP 8.2, 8.3, 8.4, and 8.5. Organizations using older PHP versions, such as PHP 8.1 and earlier, are advised to upgrade or obtain vendor-supported patches, as they are outside normal upstream support and may not have received fixes.
Prior to this, PHP had issued security advisories emphasizing that updating only WordPress themes or plugins does not mitigate core PHP engine vulnerabilities. The incident also underscores the importance of verifying runtime environments and applying comprehensive security patches across all web applications.
“The vulnerabilities involve memory handling flaws that can be exploited to execute remote code without authentication, posing a significant risk to web servers.”
— PHP Security Team
As an affiliate, we earn on qualifying purchases.
Unconfirmed Aspects of the PHP2Shell Exploits
While patches have been released and some attack attempts have been observed, it is still unclear how widespread the exploitation has been across different web hosting environments. The full extent of any breaches or malicious activities resulting from these vulnerabilities remains under investigation. Additionally, the precise methods used in successful attacks are still being analyzed, and some deployment configurations may be more vulnerable than others.
As an affiliate, we earn on qualifying purchases.
Next Steps for Website Operators and Security Teams
Website administrators and hosting providers are advised to verify their PHP environments, apply the latest security updates, and restart affected services. They should also review logs for suspicious activity and implement additional protections such as Web Application Firewalls (WAFs). Ongoing monitoring for signs of compromise is essential, as patching alone may not remove existing intrusions. PHP maintainers and vendors are expected to continue providing updates and guidance as more details emerge about the exploitation techniques and affected systems.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are the PHP2Shell vulnerabilities?
They are critical flaws in PHP’s memory management and internal state handling that can be exploited to execute remote code without authentication, potentially leading to server compromise.
Which PHP versions are affected?
Supported PHP versions from 8.2 through 8.5 have received patches. Older versions like PHP 8.1 and earlier are outside support and may not have fixes available from upstream sources.
Should I shut down my website immediately?
Not necessarily. The Dutch government took websites offline as a precaution. The recommended action is to verify your PHP environment, apply patches, restart services, and monitor for suspicious activity.
How can I verify if my PHP environment is patched?
Check your PHP version and ensure it is updated to the latest patched release for your branch. Confirm with your hosting provider or system administrator that the patches addressing CVE-2026-109618 and CVE-2026-109619 are applied.
What additional security measures should I take?
Implement WAF protections, review logs regularly, restrict access where possible, and keep software up to date. Consider temporarily disabling vulnerable services if needed until patches are confirmed applied.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
