🔍 Read the full analysis: What Caused Dutch Government Website Downtime? PHP2Shell And PHP Flaws on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The Dutch government took several websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline on 21 October 2026 as a precaution over two critical PHP vulnerabilities. The government said it had no signs of active exploitation at the time; that statement did not establish whether other systems were targeted or compromised. PHP released fixes, and the Dutch National Cyber Security Centre urged operators to patch affected runtimes.
The Dutch government took several websites offline on 21 October 2026 as a precaution after PHP disclosed two critical vulnerabilities that can allow unauthenticated remote code execution. Officials named Overheid.nl, MijnOverheid.nl and DigiD, and said there were no signs of active exploitation at the time of their announcement; the shutdown was a preventive measure, not confirmation that those services had been breached.
The vulnerabilities, collectively referred to in the source material as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories describe flaws in memory handling and request state. One involves cleanup after an out-of-memory failure, while the other involves references to request memory that has already been freed. Both can create conditions leading to remote code execution, according to the advisories. Each has a CVSS v4.0 score of 9.2, rated Critical.
PHP released patched versions on 21 October for supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support. The source says PHP also supplied limited source backports for versions 7.4, 8.0 and 8.1. Organizations using distribution packages or extended support should check with their vendor for a fixed build; a version number by itself may not show whether a backport has been applied.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its guidance says systems that remain unpatched should stay offline as a precaution. The government also said many other government websites, including Rijksoverheid.nl, do not use PHP and were not affected by these specific flaws.
Why Public Services Went Offline
The incident shows how a vulnerability in a widely used server-side runtime can disrupt access to public services even when an organization has no confirmed breach to report. Taking a site offline can reduce exposure while operators establish which PHP versions and configurations are in use and apply fixes. For users, that can mean temporary loss of access to government information or online services such as DigiD.
The risk is not limited to one content management system. The flaws affect the PHP runtime beneath an application, so updating WordPress, Drupal or Joomla code alone does not address them. The source material reports demonstrations of unauthenticated code execution on those platforms, but describes these as effects of the PHP engine flaws, not separate vulnerabilities in each CMS. It also reports possible disclosure of sensitive process memory, which could expose credentials or tokens in some circumstances.
For businesses and public bodies that use managed hosting, the practical issue is whether the provider patched the PHP runtime actually serving each site. A current application dashboard does not answer that question. Operators also need to account for their web server and PHP configuration: reported demonstrations include Apache with mod_php, while PHP-FPM behavior can vary and does not establish blanket protection.
Products Worth Considering
DJI Mini 5 Pro Fly More Combo with DJI RC 2
Jackery Explorer 1000 v2 Portable Power Station
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
As an affiliate, we earn on qualifying purchases.
How PHP2Shell Was Described
PHP’s advisories identify web-request handling installations as potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The source material says demonstrated attacks on Apache with mod_php can occur before application code runs. It also cites research describing application-dependent paths involving PHP-FPM, so differences in configuration matter when assessing exposure.
The Dutch government’s first public explanation described its shutdowns as precautionary and said it saw no signs of active exploitation at that time. Separately, Cloudflare reported observing attack traffic and attempts to modify payloads to bypass its protections. Those observations indicate attempted exploitation as reported by the company; they do not establish that the Dutch services named by officials were compromised.
The reporting also describes security research involving AI tools. OpenAI said Calif identified a critical flaw through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities, according to the source material. PHP maintainers issued the fixes. Calif’s account says the initial discovery used generally available models and involved a researcher directing the investigation with knowledge of PHP’s vulnerability history. These are attributed accounts of the research process, not evidence that AI alone found or fixed the flaws.
“The named websites were taken offline as a precaution, and the announcement reported no signs of active exploitation at that time.”
— The Dutch government
What Is Known About Exposure
The available material does not say when every affected Dutch service returned online, whether all named sites used vulnerable PHP configurations, or whether an investigation later found attempted access to those systems. The government’s statement that it had no signs of active exploitation was limited to the time of that announcement; it should not be read as proof that no attacks occurred elsewhere or at a later time.
Cloudflare’s report concerns attack traffic it observed, but the supplied information does not identify the targets or establish that any attempt succeeded. Exposure also depends on the PHP branch, the package supplied by a vendor, and the server configuration. The reported remote-code-execution demonstrations show potential impact, but do not confirm exploitation of every listed platform or installation.
Patch Verification and Service Restoration
Organizations should confirm which PHP runtime and web-server configuration serve each public-facing site, then apply the fixed release from PHP or the relevant operating-system, hosting or extended-support vendor. They should verify that the patched runtime is the one actually handling requests. The Dutch NCSC’s stated guidance is to keep systems that have not been updated offline until they are patched.
For users, the next useful update is an official notice confirming whether the affected Dutch services have returned and whether authorities have found evidence of compromise. The supplied source material does not provide a restoration timetable or a final incident assessment. Further statements from the Dutch government, the NCSC and service operators would clarify those points.
Key Questions
Were the Dutch government websites confirmed to be hacked?
No. The government said the sites were taken offline as a precaution and reported no signs of active exploitation at the time of its announcement. That does not establish what later investigations may find.
Which PHP versions contain the fixes?
The releases listed in the source material are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Operators using older branches or vendor-provided packages should check whether their provider has issued a fixed package or backport.
Will updating WordPress or its plugins fix PHP2Shell?
No. These flaws affect the PHP runtime used to run an application. Updating website code or plugins alone does not patch that runtime; site owners should confirm the hosting provider has updated the PHP software serving their site.
Does the reported attack traffic mean the named Dutch sites were compromised?
No. Cloudflare reported seeing attack traffic and attempts to alter payloads, but the supplied report does not establish that those attempts targeted the named Dutch websites or succeeded. The Dutch government separately said it had no signs of active exploitation at the time of its announcement.
Source: ThorstenMeyerAI.com
