Critical PHP Vulnerabilities: What UK Organisations Need to Know About PHP2Shell

The National Cyber Security Centre has issued direct guidance to UK organisations urging immediate action on two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known collectively as PHP2Shell. The flaws allow unauthenticated remote code execution, meaning an attacker can take full control of an affected server without requiring any valid credentials or prior access. PHP underpins approximately 70 per cent of websites globally, and exploitation attempts were confirmed before patches were publicly released. Patched versions — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — are now available, and active exploitation has been reported across the internet.

Why this matters for UK organisations

The scale of PHP's deployment across the web means that the potential impact of these vulnerabilities is unusually broad. Any organisation running PHP-based web applications, content management systems such as WordPress, Drupal or Joomla, or custom-built web services is potentially exposed if they have not yet applied the available patches. The fact that exploitation requires no authentication lowers the barrier for attackers significantly — there is no need to obtain credentials, bypass login controls or conduct reconnaissance before attempting to exploit the flaw. The NCSC's direct advisory to UK organisations reflects the seriousness of the risk, and reporting from SecurityWeek and Wired confirms that exploitation was already underway before patches were released, with Amazon Web Services logging active attempts four days prior to the patch release. Organisations using managed hosting providers should not assume that patching has been handled automatically and should seek explicit confirmation.

What to review

The immediate priority is to identify all PHP installations across your environment and confirm which version is running. Any version below the patched releases should be updated as a matter of urgency. Where patching cannot be completed immediately, consider whether web application firewall rules or other compensating controls can reduce exposure in the short term. Organisations relying on third-party hosting or managed service providers should contact those providers directly to confirm patch status rather than assuming it has been handled. It is also worth reviewing web server logs for any unusual activity or unexpected requests that may indicate exploitation attempts have already occurred, and ensuring that incident response contacts are available and aware of the situation.

Source: NCSC UK