Two critical flaws in PHP, the language behind most of the web, forced governments and companies to pull websites offline last week. The NCSC’s advice is blunt: patch immediately, or take the system offline until you can. Here is what happened, who is exposed, and exactly what to do next.
What happened
On 20 October 2026, details of two critical vulnerabilities in PHP leaked online ahead of their planned disclosure. The PHP project released emergency fixes the following day, 21 October, and by then organisations across Europe, the US and the UK were already taking websites offline as a precaution.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are known collectively as PHP2Shell. Both carry a CVSS v4.0 score of 9.2 out of 10, and both can allow an attacker to run code on a web server without logging in. In plain terms, a single crafted web request could hand someone control of the server behind your website.
The scale of the reaction to PHP2Shell was unusual. Downing Street warned that some government services might be temporarily unavailable, while confirming that no large public-facing critical services had been affected. Edinburgh council and the BBC were among the UK bodies that took pages offline. Cloudflare’s chief executive, Matthew Prince, said the company had seen millions of attempts to exploit the flaws.
BY THE NUMBERS
- 9.2 / 10 CVSS v4.0 severity score for both PHP2Shell flaws
- 70% Share of websites worldwide that run on PHP
- 17 Oct Earliest exploitation attempt seen, four days before public disclosure
- Millions Exploitation attempts recorded by Cloudflare within days
Why this one is different
Two things set PHP2Shell apart from the usual monthly patch cycle.
First, the reach. PHP runs on roughly seven in ten websites, according to Kaspersky, and the PHP developers have said that every installation serving web requests is potentially affected, whether it runs on PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. That includes WordPress sites, customer portals, intranets and line-of-business applications that most boards would not think of as “PHP” at all.
Second, the way the flaws were found. Researchers at Calif and Wiz used frontier AI models to uncover bugs that had sat undetected in PHP for more than a decade. Wiz described the findings as among the most severe ever discovered in PHP. The lesson for every business is that AI is now shortening the gap between a hidden weakness and a working exploit, and attackers have access to the same tools.
PHP2Shell exploitation is already under way. Security firm watchTowr reported attacks in the wild on the day the patches shipped, and Amazon Threat Intelligence identified an exploitation attempt dating back to 17 October, four days before public disclosure. If your servers were exposed during that window, patching alone is not enough. You also need to check whether anyone got in.
7 steps to protect your business from PHP2Shell
1. Find every system that runs PHP
Start with a complete inventory, because PHP2Shell reaches far beyond your public website. Your website is the obvious one, but also check intranets, booking and payment pages, HR and ticketing tools, marketing microsites and any third-party software with a PHP dependency. The Dutch NCSC has published an inventory of software products with PHP dependencies on GitHub, which is a useful starting checklist.
2. Patch to a fixed version immediately
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP core developer Gina Peter Banyard has warned that no workaround fully blocks these attacks, and that applying the official patches is the only permanent fix. If you run PHP in containers, rebuild your images so they pull the new base image rather than a cached one.
3. If you are on PHP 8.1 or older, treat it as an emergency
PHP 8.1 and earlier versions no longer receive updates from the PHP project, so there is no official fix for them. Your options are an extended-support or Linux distribution backport, an emergency configuration mitigation while you upgrade, or taking the system offline. Running unsupported PHP was already a risk. After PHP2Shell, it is an open door.
4. Get written confirmation from your host or IT provider
If your website sits on shared hosting or is managed by an agency or managed service provider, do not assume it has been patched. Ask for written confirmation of the PHP version now running on every server that hosts your services, and the date the update was applied.
5. Look for signs of compromise since 17 October
Review web server and application logs for unusual requests, including any with “php2shell” in the user-agent string, which watchTowr saw in early attack attempts. Check for new administrator accounts, unexpected files in web directories and unfamiliar outbound connections from your servers. If anything looks wrong, isolate the system and bring in incident response support. The NCSC maintains a list of assured cyber incident response providers.
6. Use a web application firewall as a stopgap, not a fix
Cloudflare and other providers deployed firewall rules to block known exploitation patterns before the patches were released. These buy time, but attackers adapt quickly. A firewall rule should sit alongside patching, never replace it.
7. Prepare for more of this
The NCSC has urged organisations to prepare for a “vulnerability patch wave” as AI-assisted research uncovers older flaws faster. That means knowing what software you run, having an agreed process to patch critical issues within hours rather than weeks, and testing that your backups and recovery plans actually work.
What the NCSC is telling UK organisations about PHP2Shell
The UK’s National Cyber Security Centre has encouraged organisations to take immediate action and to follow vendor guidance. Where immediate remediation is not feasible, its advice is to consider taking the affected system offline until it can be fully mitigated. That is unusually direct language, and boards should treat it as such.
The bigger picture
PHP2Shell arrived in the same week that a power failure at a Google Cloud facility in London disrupted UK banking apps, while UK retailers were still recovering from cyber attacks. Taken together, these events show how much of the UK economy rests on shared software and shared infrastructure that most businesses never see. Resilience now depends less on any single product and more on visibility: knowing what you run, who runs it for you, and how quickly you can respond.
Not sure whether your systems are exposed?
Cloud Technology Hub can run a rapid PHP2Shell exposure check across your websites, servers and hosted applications, confirm patch status with your providers and review logs for signs of compromise. Email info@technohub.cloud to book a check this week.
Speak to our team at info@technohub.cloud. TALK
Leave a comment and Read More Here
