TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP released emergency fixes on 21 October 2026 for two critical vulnerabilities that can allow remote code execution without authentication. The Dutch government said it took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; it did not report confirmed compromises of those services.
PHP’s security team disclosed CVE-2026-109618 and CVE-2026-109619 and released emergency updates for both on 21 October. Each carries a CVSS v4.0 score of 9.2, classified as Critical. The flaws involve memory handling and request state; PHP says they can lead to remote code execution without authentication in affected deployments.
The advisory lists web-facing installations using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as potentially at risk. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Operators using vendor packages need to confirm that their supplier has incorporated fixes for both CVEs.
The shutdowns were one reported operational response. Cloudflare separately reported attack attempts against its customers, but the source material does not establish that those attempts targeted Dutch government services or succeeded. PHP’s advisory reports demonstrated exploitation on Apache with mod_php; code execution as a web worker does not by itself establish access to administrator or root privileges.
Cybersecurity • Public services • 21 October 2026
Dutch Government Websites Go Offline Amid PHP2Shell Flaw Exposure
The Netherlands took major public portals offline as a precaution after PHP disclosed two critical flaws that may allow remote code execution without authentication. No confirmed compromise of the named services was reported.
01 / The exposure
One runtime, two failure paths
PHP says both vulnerabilities can lead to code execution in affected deployments. The execution context and exploit path depend on the server setup and permissions.
Out-of-memory failure
CVE-2026-109618 can interrupt initialization of internal request data. Later cleanup may treat invalid data as valid, causing memory corruption and potentially code execution.
Use-after-free condition
CVE-2026-109619 involves worker state retaining references after memory is freed. A later request handled by that worker may use the stale reference and potentially execute code.
02 / Who may be affected
Check the live web runtime
Risk concerns PHP handling web requests. Updating site content, a WordPress theme or a plugin does not fix the underlying runtime.
Multiple server paths
The advisory lists PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as potentially at risk.
Not every path is identical
PHP reports demonstrated exploitation with Apache mod_php. PHP-FPM may behave differently in some scenarios; that does not establish immunity.
Worker access is not root
Code runs with the web worker’s permissions. That can expose application data or affect an app, but does not automatically grant administrator or root access.
03 / Patch status
Fixed releases by PHP branch
PHP released fixes on 21 October 2026. Vendor packages may include backports, so confirm that both CVEs are addressed.
| PHP branch | Fixed release | Operator check |
|---|---|---|
| 8.5 | 8.5.12 | Update and verify |
| 8.4 | 8.4.27 | Update and verify |
| 8.3 | 8.3.36 | Update and verify |
| 8.2 | 8.2.35 | Update and verify |
| 7.4 · 8.0 · 8.1 | Minimal source backports | Confirm with supplier |
04 / Response workflow
Patch, verify, then review
A version number alone may not show whether a vendor backport is present. Confirm the fix in the package actually serving production traffic.
Inventory
Include production, staging and legacy sites; identify each web-serving PHP runtime.
Apply both fixes
Install a listed release or a supplier package confirmed to address both CVEs.
Restart and verify
Redeploy or restart as required, then confirm live requests use the updated runtime.
Test and review
Check site functions and relevant logs for suspicious activity after patching.
A web application firewall can add a layer of defense, but it does not replace the software fix.
Patching does not remove an intrusion that may already have occurred. Review logs and investigate signs of access.
05 / What remains unknown
Service status and exposure are open
The available source material does not establish the full scale of exposure or the current status of the Dutch portals.
No return time reported
It is unclear how long the services remained offline, whether all were affected in the same way, or whether they have returned.
No confirmed compromise announced
The shutdown was described as precautionary. The source does not say whether investigators found evidence of intrusion or ruled one out.
Attempts do not prove success
Cloudflare reported attack attempts against its customers. The source does not link them to Dutch government services or report successful access.
06 / Key questions
What operators and readers should know
Which Dutch websites were named?
Overheid.nl, MijnOverheid.nl and DigiD were named among services taken offline as a precaution on 21 October 2026.
Was a cyberattack confirmed?
No confirmed compromise was reported in the source material. A precautionary shutdown does not establish whether an intrusion occurred.
What should website operators update?
The PHP runtime serving web requests. Updating site content, themes or plugins alone does not patch these vulnerabilities.
Does remote code execution mean root access?
No. The reported execution is as the web worker account; practical impact depends on deployment and account permissions.
Public Services Face Runtime Risk
The disclosure concerns the PHP runtime that handles web requests, so changing an application’s content, WordPress theme or plugin alone does not address the flaws. Operators need to identify which PHP version is serving each site, apply a fixed package or image, and make sure the live web process has restarted onto it.
Taking public portals offline can interrupt access to government information and services, while leaving a vulnerable service exposed may carry security risks. The Dutch government’s action shows the immediate operational tradeoff, but its statement does not say how long the sites were unavailable or whether all named services were affected in the same way.
PHP says exploitation can run code with the web worker’s permissions. That may allow an attacker to affect an application or access data available to that account, but the reported capability does not establish automatic control of the underlying server. The actual impact depends on deployment, configuration and permissions.
PHP security patch for web servers
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How PHP Describes the Flaws
PHP’s advisories describe two distinct memory-related failure paths. CVE-2026-109618 involves an out-of-memory failure that can interrupt initialization of internal request data. Later cleanup may treat invalid data as valid, potentially causing memory corruption and code execution.
CVE-2026-109619 involves internal state retaining references to memory after it has been freed. A later request handled by the same worker may use those stale references, creating a use-after-free condition that can also lead to code execution. PHP released fixes across the listed branches on 21 October.
The advisories and research cited in the source describe deployment-specific differences. Some demonstrated mod_php attacks can occur before application code runs. That does not mean every PHP setup has the same exploit path: the source says PHP-FPM handles some startup failures differently, while Calif describes application-dependent paths involving PHP-FPM. Different behavior in one scenario does not establish that a deployment is immune.
web application firewall for PHP websites
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Compromise and Recovery Status
The available source material does not say whether the Dutch websites have returned to service, how long they remained offline, or whether investigators found evidence of an intrusion. The government characterized the action as precautionary and did not announce a confirmed compromise.
It is also unclear how many vulnerable PHP deployments are exposed publicly, how many have been patched, and whether any attack attempts reported by Cloudflare led to successful access. A version number may not reveal whether an older package includes a vendor backport, so operators need confirmation from their package provider or host.
The severity rating is not a measure of the number of affected sites. Exploitation paths and consequences vary by runtime, configuration and account permissions; the source material does not provide a complete assessment of exposure across Dutch government systems.
As an affiliate, we earn on qualifying purchases.
Patch, Verify and Review Logs
Website operators should inventory production, staging and legacy sites, then identify the PHP runtime serving web requests; it may differ from command-line PHP. They should install the fixed release for their branch or a vendor package confirmed to address both CVEs. Managed-hosting customers should ask their provider to confirm that the fix is deployed.
After patching, operators need to complete any required restart or redeployment and verify that live requests reach the updated runtime. They should test site functions and review relevant logs for suspicious activity. Applying a patch does not remove an intrusion that may already have occurred, and a web application firewall is an additional protection layer rather than a replacement for the software fix.
The Dutch government’s next public update would clarify service availability and whether its investigation found signs of compromise. The source material provides no expected update time. Until deployment and incident checks are complete, the scale of exposure and the status of the affected public portals remain open questions.
As an affiliate, we earn on qualifying purchases.
Key Questions
Which Dutch websites were taken offline?
The Dutch government named Overheid.nl, MijnOverheid.nl and DigiD among websites taken offline as a precaution on 21 October 2026. The source does not provide their subsequent service status.
Did the Dutch government confirm a cyberattack on those sites?
No confirmed compromise was reported in the source material. The government described the shutdown as precautionary; that does not establish whether an intrusion occurred or whether investigators ruled one out.
What should website operators update?
They should update the PHP runtime to a fixed release or apply a vendor package confirmed to fix both CVE-2026-109618 and CVE-2026-109619. Updating site content, WordPress themes or plugins alone does not patch PHP itself.
Which PHP releases contain the fixes?
The listed fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for 7.4, 8.0 and 8.1; operators using older or vendor-supported packages should confirm the fix with their supplier.
Does remote code execution mean an attacker gets root access?
No. The source says execution can occur as the web worker account. That does not automatically grant administrator or root access; the practical consequences depend on the account’s permissions and the deployment.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
