PHP2Shell flaws trigger urgent PHP patch and Dutch site shutdowns

Two critical PHP vulnerabilities dubbed PHP2Shell were publicly disclosed, allowing remote command execution on servers without credentials under certain conditions, according to aitimes.com. The PHP development team released a fix on October 21, a day earlier than planned, after vulnerability details and an attack demo leaked ahead of schedule.

Each vulnerability was rated 9.2 out of 10 for severity. The flaws were found using AI: security firm Calif used GPT-5.6 Sol and reported in August, while Wiz independently confirmed the issue using its own AI tools plus Google's Gemini 4 Argon and GPT-5.6 Sol.

Dutch government portals, the Port of Rotterdam, the national football association, major political parties and several hospitals took public websites offline. More than 100 Dutch municipalities, provincial governments and water management authorities using Notubiz services were affected. Denmark's school communication platforms went down, and Finland, Germany and France temporarily blocked government websites.

Germany's University of Freiburg, Austria's University of Vienna, the Wikimedia Foundation and the Internet Archive shut down some sites or systems. Germany and Finland said the shutdowns were precautionary and not caused by exploitation attempts or data leaks.

Cloudflare said it has observed some early attack attempts and deployed customer protections. CISA said it had no confirmed exploitation cases as of the announcement. Roughly 1.5 million of about 2.6 million observed hosts run PHP versions that cannot easily receive the patch, according to Sensis.

Background

According to Wiz, the flaws had been in PHP code for more than 10 years but were very complex to exploit in practice. In 2024, the PHP Foundation noticed signs of one vulnerability but could not confirm a concrete attack path or decide how to fix it, which the foundation called a structural failure due to its decision-making process and lack of resources.