Informopedia Explains: on October 21, the Netherlands did something extraordinary. It pulled its own government off the internet — Overheid.nl, MijnOverheid.nl, the DigiD digital-identity system, even parliamentary websites — not because they had been hacked, but because they might be. The reason was a pair of bugs in PHP, a programming language that turned 30 this year and quietly runs most of the web. This is the story of what those bugs are, and why “might be hacked” was enough to send governments scrambling.
A thirty-year-old language that never went away
PHP was born in 1995 as “Personal Home Page Tools” — a side project by Danish-Canadian programmer Rasmus Lerdorf who wanted to track visits to his online résumé. Nobody planned for it to eat the world. But it did: by W3Techs’ count, more than 70 percent of all websites whose server-side language is known run on PHP. WordPress, Drupal, Joomla, Wikipedia, most government portals, half the news sites you read — all PHP.
Developers joke that PHP is the cockroach of the web: unglamorous, indestructible, everywhere. It survived two decades of predictions of its death. It is written into the load-bearing walls of the internet. And that is exactly why a flaw in PHP itself — not in WordPress, not in some plugin, but in the language’s engine — is a five-alarm fire. One bug, and the blast radius is measured in millions of servers.
What “remote code execution” actually means
The worst thing you can say about a security flaw is that it allows remote code execution — RCE for short. It means an attacker can run their own code on someone else’s server, from across the internet, simply by sending it a carefully crafted request. No stolen password. No phishing email. The server reads the attacker’s message and, because of the bug, obeys it.
Think of it like this: your web server is a restaurant kitchen, and a normal request is a customer ordering off the menu. RCE is a customer who slips a note into the kitchen through the food hatch — and the kitchen, misreading its own rules, starts following the note instead of the menu. Once an attacker has RCE, they can steal databases, install backdoors, and use the server as a launchpad to attack everything connected to it.
That is why the two flaws patched on October 21 got the treatment they did. Both carry CVSS severity scores of 9.2 out of 10 — the “critical” band — and both allow exactly this: unauthenticated remote code execution. Unauthenticated is the nightmare word. It means the attacker needs no account, no password, no insider access. Anyone on the internet can knock.
The two bugs, in plain language
The flaws are catalogued as CVE-2026-109618 and CVE-2026-109619, and America’s cybersecurity agency, CISA, gave the episode a name that is already sticking: PHP2Shell.
The first bug lives in PHP’s memory bookkeeping. When a web server handles your request, PHP sets aside chunks of memory to work in. If PHP runs out of memory mid-request, it is supposed to bail out cleanly. Instead, the advisory says, it could leave the request’s internal data in an unsafe, half-written state — like a cashier walking away mid-transaction with the till open and the books wrong. An attacker who triggers that state at exactly the right moment can bend it to their will.
The second is a close cousin with a classic name: use-after-free. PHP frees a block of memory — marks it as available for reuse — but some internal bookkeeping still remembers the old data. When the next request arrives and claims that memory, it can inherit the stale contents. It is the digital version of a hotel giving your keycard to the next guest while your credit card details are still printed on the checkout slip.
Both bugs sit in PHP’s core request handling, which is why the list of affected setups is so long: PHP-FPM, the Apache module mod_php, php-cgi, FrankenPHP and LiteSpeed — essentially every way of running PHP on a real web server.
Why governments went offline instead of just patching
The response was as fast as it was dramatic. The Netherlands pulled its sites as a precaution. Finland, France’s prefecture sites, Denmark and Australia took sites down too. Japan’s prime minister, Sanae Takaichi, urged institutions to check their systems. In the US, the National Security Agency pushed agencies to patch immediately; Europe’s CERT-EU told organizations that if they couldn’t patch, they should isolate any internet-facing app until they could. Cloudflare reported attack attempts in the wild. Proof-of-concept exploits — working attack recipes — started circulating almost immediately.
Why the panic, if patches existed? Because patching at internet scale is not pressing a button. Every government ministry, bank and hospital runs its own fleet of servers, and each one needs testing before an emergency update goes live — an untested patch on a tax system can do as much damage as an attack. The fixes landed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports even for long-dead branches like 7.4, 8.0 and 8.1. But between “patch released” and “patch running everywhere” lies a gap of hours to days — and with working exploits circulating, hours matter. Going offline was the Dutch buying themselves that gap.
Two honest caveats before the alarm bells go too far. First: no confirmed successful compromises of the Dutch government sites have been reported — the shutdowns were precautionary, which is the system working as intended, not failing. Second: a proof-of-concept exploit is a demonstration, not a pandemic. Vulnerable does not mean breached. The danger is real, but it is a danger of the next few days, not a catastrophe that already happened.
Why this matters
There is a pattern worth noticing. When attackers quietly hacked websites and spent someone else’s crypto for months, or when a phishing email exposed 1.3 million people in Arizona’s court system, the entry point was always the same: software so ordinary nobody thought about it until it failed. PHP is infrastructure the way bridges are infrastructure — invisible until the day one cracks. And the AI-era attack tools arriving this year mean the gap between a published flaw and a working weapon keeps shrinking.
The deeper lesson is about the shape of the modern internet. One language, written by one person in 1995 to track résumé views, now underpins the digital services of entire nations. The world standardized on it because it was free, easy and everywhere. That standardization is a strength on the 364 days a year when nothing breaks. On the 365th, it is a single point of failure the size of the planet.
What happens next
The race is on, and it has a simple scoreboard: servers patched before attackers finish weaponizing the proofs of concept. Expect the attack attempts Cloudflare is already seeing to sharpen in the coming days, and expect a quiet second wave of incidents over the next month as organizations discover the one forgotten server they didn’t patch — the old intranet box, the legacy client site, the machine nobody owned.
PHP’s maintainers did their part fast, and governments did theirs by treating “might be hacked” as seriously as “has been hacked.” If your own site runs PHP — and statistically, it probably does — the move is the same: patch tonight, not next week.
