TL;DR

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on Oct. 21, 2026, for two critical vulnerabilities that can enable unauthenticated remote code execution in affected web deployments. The Dutch government temporarily took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; it did not say those services had been compromised.

PHP released emergency security updates on Oct. 21 for two critical vulnerabilities that can allow unauthenticated attackers to execute code remotely on affected web deployments. The Dutch government said it had taken Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement did not report confirmed compromises of those services.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell in the source material, affect PHP request handling. PHP’s security advisory lists web-facing configurations including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as potentially at risk. Both vulnerabilities received a CVSS v4.0 score of 9.2, rated Critical. A severity score does not establish that every installation is exploitable in the same way.

PHP’s advisories describe two memory-management failures. In CVE-2026-109618, an out-of-memory failure can interrupt initialization, after which cleanup may handle invalid request data as if it were valid. CVE-2026-109619 involves internal state retaining references to memory freed after a request; a later request handled by the same worker may encounter those stale references. The described consequences include memory corruption and remote code execution. PHP reports demonstrated exploitation with Apache mod_php; execution as the web worker does not by itself mean an attacker gains administrator or root access.

The fixed releases listed for supported branches are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The source says PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Operators using older versions or managed hosting need to confirm with their vendor that the deployed package addresses both CVEs. Updating WordPress, themes or plugins alone does not patch the PHP engine.

Patching the Web Runtime

The flaws affect the software that processes web requests, so remediation must reach the PHP runtime serving each site. A server may have a different PHP version for command-line tasks than for its websites. Operators need to identify production, staging and legacy deployments, apply a fixed release or vendor-confirmed package, and complete any required restart or redeployment.

The Dutch shutdowns show the potential operational impact of precautionary response to a high-severity flaw. The government’s announcement described taking services offline to reduce risk; it did not establish that attackers had accessed them. Cloudflare separately reported attack attempts against its customers, according to the supplied source. That report indicates attempted activity but does not, by itself, confirm successful exploitation of any particular customer.

Installing a patch also does not determine whether an intrusion happened before the update. The source advises operators to preserve relevant logs and review suspicious activity. Web application firewalls can add protection, but they do not replace fixing the vulnerable runtime. PHP execution as a web worker also does not automatically confer access to the whole server.

How PHP2Shell Works

The two issues share a broad theme: request processing and memory state. One flaw concerns cleanup after an interrupted operation; the other concerns internal references that can outlast the memory they point to. The advisories describe potential paths to code execution, while the exact exposure depends on the PHP deployment and configuration.

PHP lists several ways of serving web requests as potentially affected. The source material says attacks have been demonstrated on Apache with mod_php, including paths that can occur before application code runs. It also cites research describing application-dependent exploitation paths involving PHP-FPM. Differences between server setups matter when evaluating exposure; one configuration’s behavior does not establish that another is safe.

The supplied account says researchers associated with Calif, OpenAI and Wiz used AI-assisted methods in finding the flaws, including GPT-5.6 Sol and Gemini 4 Argon. PHP maintainers led the fixes and release, and the source stresses that expert investigation and deployment work remained necessary. These are claims attributed to the researchers and organizations in the supplied material; the PHP security advisories remain the primary technical guidance for operators.

“The advisory identifies web-facing PHP installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, as at risk.”

— PHP security advisory

Exposure and Breach Status

The supplied material does not say whether the Dutch services were compromised, and the government announcement is described as precautionary. It also does not establish how many PHP deployments are exposed or how many attacks succeeded. Exploitability varies by version, configuration and application, and a critical rating alone cannot answer whether a specific site can be reached through a particular attack path.

For installations on older or vendor-maintained branches, operators should seek confirmation that their exact package includes both fixes. Version numbers may not reveal a backport. The source material also does not provide a complete account of the attack attempts Cloudflare reported or identify successful intrusions tied to them.

Operator Checks and Updates

Website operators should inventory PHP runtimes across live, staging and legacy services; apply the fixed release for their branch or a vendor-confirmed package; then restart or redeploy as required. They should verify that web requests reach the patched runtime, since command-line PHP may not match the web server’s version, and test site functions after deployment.

Where an immediate update is not possible, the supplied guidance recommends discussing access restrictions or temporary offline operation with the hosting provider. Operators should keep relevant protections enabled while patching, review official configuration mitigations for the specific attack paths they address, and preserve logs for investigation. Patch status and signs of prior activity are separate checks: a successful update does not resolve whether an earlier intrusion occurred.

The next public developments to watch are further advisories from PHP and affected vendors, confirmation of fixes on managed hosting platforms, and any updated statements from Dutch authorities about the services taken offline. The supplied material does not provide a restoration timeline or report a confirmed compromise of those Dutch sites.

Key Questions

What are the PHP2Shell vulnerabilities?

They are two PHP flaws, CVE-2026-109618 and CVE-2026-109619, involving interrupted memory handling and stale references to freed memory. PHP says the issues can lead to remote code execution in affected web deployments.

Were DigiD and the other Dutch websites hacked?

The Dutch government said the sites were taken offline as a precaution. The supplied announcement did not report confirmed compromises.

Which PHP releases contain the fixes?

The supplied advisory lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Operators on older or vendor-supported branches should confirm directly that their package includes fixes for both CVEs.

Will updating WordPress or its plugins fix the issue?

No. These vulnerabilities affect the PHP runtime, so updating WordPress, themes or plugins alone does not patch them. Operators need to update or obtain a fixed PHP package and verify the web-facing runtime is using it.

Does remote code execution mean an attacker gets root access?

Not automatically. The supplied PHP advisory describes execution as the web worker account. The attacker’s access depends on the server’s permissions and configuration.

Source: Thorsten Meyer AI