🔍 Read the full analysis: Why Dutch Government Websites Went Offline As PHP2Shell Exposed PHP Flaws on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
The Dutch government took several websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline on 21 October 2026 as a precaution over two critical PHP vulnerabilities called PHP2Shell. The government said it had no signs those services were actively exploited at the time; PHP and the Dutch National Cyber Security Centre said fixes were available and urged operators to patch.
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP disclosed two critical vulnerabilities that can enable unauthenticated remote code execution. The government said it had no signs of active exploitation affecting those services at the time of its announcement; the shutdown was preventive, not confirmation of a breach.
The flaws, grouped under the name PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign both a CVSS v4.0 score of 9.2, rated critical. The vulnerabilities affect PHP installations handling web requests, including configurations using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP released fixed versions on 21 October: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Organizations using vendor-maintained or extended-support packages should check with their supplier for a fixed build; a version number alone may not show whether a backport has been applied.
The Dutch National Cyber Security Centre said patches were available and advised organizations to update. Its guidance says systems that have not been updated should remain offline as a precaution. The government also said many Dutch public websites, including Rijksoverheid.nl, do not use PHP and were not affected by these specific flaws.
Cybersecurity briefing · Netherlands · 21 October 2026
Why Dutch Government Websites Went Offline As PHP2Shell Exposed PHP Flaws
Several public services were taken offline as a precaution after PHP disclosed two critical vulnerabilities. Authorities reported no signs of active exploitation affecting the named services at the time of the announcement.
01 / Scope and context
A runtime flaw can reach many sites
PHP runs beneath websites and content management systems. The risk sits in the runtime that handles web requests, even when site code and plugins are current.
Overheid.nl
Named among the public services temporarily paused as a precaution.
MijnOverheid.nl
Service availability was disrupted while operators assessed and addressed exposure.
DigiD
The government included the digital identity service in the precautionary shutdown.
02 / Vulnerability mechanics
Two memory errors, one serious risk
PHP advisories describe flaws in internal memory handling and request state that can lead to unauthenticated remote code execution.
Out-of-memory failure
An interrupted operation can leave request data only partly initialized. Later cleanup may treat invalid data as valid, causing memory corruption and potentially code execution.
Use after free
Internal state can refer to memory that has already been released. A later request may use that stale reference, creating a path to memory corruption and remote code execution.
Unauthenticated web traffic reaches a vulnerable runtime.
Request handling triggers unsafe memory state.
Code execution or sensitive process memory exposure may result.
Operators patch, verify, or keep exposed services offline.
Demonstrations included Apache with mod_php and application-dependent PHP-FPM paths. Execution as a web worker does not by itself imply administrator or root access.
03 / Patch and verify
Update the PHP runtime serving requests
A CMS update alone does not resolve a PHP runtime vulnerability. Confirm the running build, including vendor backports and hosted environments.
PHP fixed releases
Minimal source backports were also provided for PHP 7.4, 8.0 and 8.1. These branches are outside normal upstream support; ask the package or hosting supplier to confirm a fixed build.
04 / Evidence and open questions
What is known—and what is not
Attack attempts and a precautionary outage matter, but neither alone establishes that a named Dutch service was compromised.
Authorities reported no signs of active exploitation affecting the services at the time of their announcement.
Cloudflare reported attack traffic and attempts to alter payloads to bypass protections. This does not confirm a breach of Dutch services.
The supplied information gives no final restoration timetable, global exposure count, or complete remediation total.
05 / Quick answers
Key questions
Were Dutch government websites hacked?
The government said it had no signs of active exploitation affecting the services when it announced the shutdown. The available information does not establish a compromise.
Which services were taken offline?
Overheid.nl, MijnOverheid.nl and DigiD were named. Many sites, including Rijksoverheid.nl, were said not to use PHP.
What should website operators update?
Update the PHP runtime or obtain a fixed supplier package. Updating WordPress, Drupal, Joomla or plugins alone is not sufficient.
Does attack traffic mean a Dutch service was breached?
No. Cloudflare observed attack attempts, but that does not confirm compromise of any named Dutch service.
Why PHP Runtime Patching Matters
PHP sits beneath many websites and content-management systems, so the exposure is not limited to one application. A vulnerable runtime can put sites using WordPress, Drupal or Joomla at risk even if their application code and plugins are current. Cloudflare warned that updating a website or its plugins alone does not address vulnerabilities in the PHP software that runs it.
Research by Wiz demonstrated unauthenticated code execution against deployments of those content-management systems, as well as possible disclosure of sensitive process memory such as credentials and tokens. These are demonstrations of the PHP flaws, not separate defects in each CMS. The practical question for organizations using managed hosting is whether the provider has patched the runtime serving each site.
The issue also shows why a precautionary outage can be significant even without a confirmed intrusion. Public services may be temporarily unavailable while their operators establish exposure and apply fixes. That disruption is distinct from evidence that attackers accessed data or systems, which the Dutch announcement did not report.
Popular right now
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Cypress Green
Bose QuietComfort Wireless Bluetooth Headphones – Active Over‑Ear Noise Cancelling with Mic, USB‑C Charging, Deep Bass, up to 24 h Playtime,
TCL 65-Inch 4K UHD Smart LED TV (65S425)
As an affiliate, we earn on qualifying purchases.
How the Two PHP Flaws Work
According to PHP’s advisories, the vulnerabilities involve internal memory handling and request state. CVE-2026-109618 concerns an out-of-memory failure that interrupts an operation before request data is fully initialized; subsequent cleanup may handle invalid data as if it were valid, causing memory corruption. CVE-2026-109619 involves internal state referring to memory that has already been freed, creating a use-after-free condition during a later request.
PHP says the resulting conditions can lead to remote code execution. Researchers reported demonstrated exploitation on Apache with mod_php. The advisory for the out-of-memory flaw says code would run as the web worker account, which does not by itself imply administrator or root access. Calif’s research describes application-dependent paths involving PHP-FPM, so differences between PHP configurations should not be treated as proof that a setup is safe.
The disclosure involved several research and infrastructure groups. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz said it independently discovered and reported both vulnerabilities. PHP maintainers issued the fixes. Calif’s account says its discovery used generally available models and depended on a researcher directing the investigation with knowledge of PHP’s vulnerability history.
“The named websites were taken offline as a precaution; the announcement reported no signs of active exploitation at the time.”
— The Dutch government
What Is Still Unknown
The Dutch government reported no signs of active exploitation of the services it took offline when it made its announcement. That does not establish whether later investigation found anything, and the supplied statements do not give a final account of when each site returned or whether every affected system was patched.
Cloudflare reported observing attack traffic and attempts to alter payloads to bypass its protections. Those observations indicate attempted exploitation, but they do not show that Overheid.nl, MijnOverheid.nl, DigiD or any other named Dutch service was compromised. The source material also does not specify how many PHP installations were exposed worldwide or how many organizations had completed remediation.
Patch Checks and Service Restoration
Operators should confirm which PHP runtime and configuration serve each website, apply the fixed release or a verified vendor backport, and check that the patched runtime is the one actually handling public requests. Hosting customers may need confirmation from their provider; updating a CMS alone is not sufficient.
Dutch agencies and other affected operators can restore services once they have applied fixes and completed their checks, but the supplied announcements do not give a restoration timetable. The next public information to watch for is updated guidance from the Dutch NCSC, PHP maintainers and hosting providers, along with any official account of service availability or confirmed impact.
Key Questions
Were Dutch government websites hacked?
The Dutch government said it had no signs of active exploitation affecting the services it took offline when it announced the precautionary shutdown. The available information does not establish that those sites were compromised.
Which Dutch websites were taken offline?
The government named Overheid.nl, MijnOverheid.nl and DigiD. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were unaffected by these particular vulnerabilities.
What should website operators update?
Operators need to update the PHP runtime serving their websites, or obtain a fixed package from their distribution or hosting provider. Updating WordPress, Drupal, Joomla or plugins by itself does not fix PHP2Shell.
Which PHP releases contain the fixes?
PHP listed fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Backports were also provided for PHP 7.4, 8.0 and 8.1; operators should verify with their package supplier whether a particular build contains the fix.
Does attack traffic mean a Dutch service was breached?
No. Cloudflare reported observing attack traffic and attempts to bypass protections, but those observations do not confirm a breach of the Dutch websites. The government separately said it had no signs of active exploitation at the time of its announcement.
Source: ThorstenMeyerAI.com
