🔍 Read the full analysis: Dutch Government Websites Go Offline As PHP2Shell Draws Security Attention on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP disclosed two critical vulnerabilities, collectively called PHP2Shell. Officials said there were no signs of active exploitation of those services at the time of their announcement; security providers reported observing attack attempts, which do not establish that the Dutch sites were compromised.
The Dutch government took several public websites offline on 21 October as a precaution after PHP disclosed two critical vulnerabilities that could allow attackers to run code remotely without logging in. The affected services included Overheid.nl, MijnOverheid.nl and DigiD; the government said its decision was preventive and reported no signs that those services had been actively exploited at the time of its announcement.
The vulnerabilities, collectively referred to as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories describe flaws in how the runtime handles memory and internal state when processing a request is interrupted. Both carry a CVSS v4.0 score of 9.2, rated Critical, and can create conditions for remote code execution.
PHP released fixes on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advisory identifies web-facing configurations including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as relevant to exposure. PHP and security researchers have demonstrated exploitation in particular deployments; those demonstrations do not establish that every server using PHP is exploitable in the same way.
The Dutch National Cyber Security Centre said patches were available and urged organizations to apply them. Its guidance says systems that remain unpatched should stay offline as a precaution. The government also said many Dutch government sites, including Rijksoverheid.nl, do not use PHP and were not affected by these specific flaws.
Cybersecurity • Netherlands • 21 October 2026
Dutch Government Websites Go Offline as PHP2Shell Draws Security Attention
Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution after two critical PHP flaws raised remote code execution concerns. Officials reported no signs of active exploitation of the services at the time of their announcement.
01 / What happened
A precautionary shutdown
The outage reduced exposure while operators assessed the runtime and applied fixes. It also interrupted access to public services used by residents and businesses.
Portals taken offline
Overheid.nl, MijnOverheid.nl and DigiD were taken offline on 21 October. The announcement described the action as preventive.
Attempts are not a breach
Cloudflare reported attack traffic and payload changes intended to bypass protections. Those observations do not show that the Dutch portals were successfully attacked.
Not every site was affected
The government said many Dutch government sites, including Rijksoverheid.nl, do not use PHP and were unaffected by these specific flaws.
02 / The vulnerabilities
Two flaws in request handling
PHP advisories describe memory and internal-state failures that can create conditions for unauthenticated remote code execution in vulnerable deployments.
Interrupted initialization
An out-of-memory failure may interrupt an operation before request data is fully initialized. Cleanup can then treat invalid data as valid, potentially causing memory corruption.
Use after free
Internal state may retain references to memory that has already been freed. A later request encountering those references can trigger unsafe behavior.
Impact depends on deployment. PHP demonstrated exploitation on Apache with mod_php. Research also describes application-dependent paths involving PHP-FPM. These examples do not prove that every PHP server is exploitable in the same way, or that code execution automatically grants administrator access.
03 / Patch status
Fixed versions and exposure
PHP released fixes on 21 October 2026. Check the runtime actually serving live requests, including vendor backports and managed hosting packages.
04 / Response path
From inventory to safe restoration
The Dutch National Cyber Security Centre said patches were available and urged organizations to apply them. Unpatched systems should remain offline as a precaution.
Application updates are not enough. Updating WordPress, Drupal, Joomla or plugins does not patch the underlying PHP runtime. Managed hosting customers should ask their provider to confirm the relevant runtime has been updated.
05 / What is known
Evidence, boundaries and open questions
The supplied announcement does not include a restoration timetable or later forensic findings. Keep precautionary actions distinct from confirmed incident evidence.
Precautionary action
The named portals were taken offline, and officials said there were no signs of active exploitation at that time.
Attack attempts
Cloudflare observed attack traffic and attempts to alter payloads. This is evidence of attempted exploitation activity, not proof of a compromise of the Dutch services.
Later status
The available information does not say when each portal was restored, whether later checks found attempted access, or how many other organizations were compromised.
06 / Key questions
Quick answers
Use the distinction between vulnerable software, attempted attacks and confirmed compromise when interpreting reports.
What is PHP2Shell?
A collective name for CVE-2026-109618 and CVE-2026-109619. PHP says both can create conditions that may allow remote code execution.
Were the Dutch websites hacked?
The government said the sites were taken offline as a precaution and reported no signs of active exploitation at that time. The available information does not confirm a breach.
Does updating WordPress fix PHP2Shell?
No. The vulnerabilities affect the PHP runtime beneath the website application. Updating application code or plugins alone does not patch PHP.
Which releases include fixes?
PHP listed 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. Older or vendor-supported versions require supplier guidance.
Does reported attack traffic prove compromise?
No. Attack attempts show activity in monitored environments; they do not establish successful access to the Dutch portals.
What should operators do?
Identify the runtime, apply a fixed release or verified backport, confirm the live service uses it, and keep unpatched systems offline until remediation is complete.
Public Services Depend on Runtime Patching
The shutdown shows how a vulnerability in a widely used server-side runtime can affect access to essential services even when there is no confirmed compromise. Taking a site offline can reduce exposure while operators verify their software and apply fixes, but it also interrupts access for residents and businesses relying on government portals.
The distinction between the application and the runtime matters for organizations beyond government. Updating a content-management system or its plugins does not by itself patch PHP. Operators need to know which PHP version and configuration actually serve each site, and whether their hosting provider has installed a fixed package. A service can remain exposed if its application looks current while the underlying runtime is not.
Security provider Cloudflare reported observing attack traffic and attempts to alter payloads to bypass protections. That is evidence of attempted exploitation activity, not proof that the named Dutch services were attacked successfully or compromised. The two facts together explain the pressure on operators: exploitation attempts have been reported, while precautionary shutdowns can be taken before an incident is confirmed.
As an affiliate, we earn on qualifying purchases.
Two Flaws in PHP Request Handling
According to PHP’s advisories, one flaw involves an out-of-memory failure interrupting an operation before request data is fully initialized. Cleanup may then handle invalid data as if it were valid, potentially causing memory corruption. The other involves internal state retaining references to memory that has already been freed, creating a use-after-free condition when a later request encounters those references.
PHP reports demonstrated exploitation on Apache with mod_php. The out-of-memory advisory says code execution occurs as the web worker account; that does not automatically grant administrator or root access. Researchers have also described application-dependent exploitation paths involving PHP-FPM, so differences in request handling should not be treated as proof that a configuration is immune.
PHP 8.1 and older are outside normal upstream support. The project provided minimal source backports for versions 7.4, 8.0 and 8.1 because of the severity, but organizations using distribution packages or extended support should follow their vendor’s security guidance. A version number alone may not show whether a vendor has applied a backport.
“The websites were taken offline as a precaution.”
— The Dutch government
PHP vulnerability scanner software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
No Confirmed Breach Reported
The Dutch government’s initial statement said there were no signs of active exploitation of the affected services at that time. The source material does not establish whether the sites were later restored, whether subsequent forensic checks found attempted access, or how long each service remained unavailable.
Cloudflare’s observations concern attack attempts across the environments it monitors; they do not identify the Dutch portals as successful targets. It is also not clear from the available information how many other organizations have vulnerable PHP deployments, how quickly hosting providers will patch them, or whether any reported exploitation resulted in confirmed compromise elsewhere.
Exposure depends on the PHP version, server configuration and request path. Demonstrations against particular setups show possible impact, but they do not prove that all PHP-based sites can be exploited by the same method.
web application firewall for PHP servers
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Organizations should identify the PHP runtime serving each public-facing site, apply the fixed release or a verified vendor backport, and confirm that the patched runtime is the one handling live requests. Sites still running unpatched systems should follow the Dutch NCSC’s advice to remain offline until remediation is complete.
For managed hosting customers, the next step is to obtain confirmation from the provider that the relevant runtime has been updated—not just that application code or plugins are current. The Dutch government may provide further information on service availability or its security assessment; no restoration timetable is included in the supplied announcement.
remote code execution prevention tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the collective name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP says both can create conditions that may allow remote code execution.
Were the Dutch government websites hacked?
The government’s announcement said the sites were taken offline as a precaution and that there were no signs of active exploitation at that time. The available information does not confirm a breach of Overheid.nl, MijnOverheid.nl or DigiD.
Does updating WordPress fix these vulnerabilities?
No. PHP2Shell affects the PHP runtime beneath the website application. Updating WordPress, Drupal, Joomla or plugins alone does not patch the PHP software serving the site.
Which PHP versions include the fixes?
PHP listed fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. Organizations on older or vendor-supported versions should check for a fixed package or backport from their supplier.
Does reported attack traffic mean the Dutch sites were compromised?
No. Cloudflare reported observing attack traffic and payload changes aimed at bypassing protections, but those observations do not establish that the named Dutch services were targeted successfully or compromised.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
