Critical PHP Vulnerabilities: What UK Organisations Need to Know and Do Now

The NCSC has issued guidance urging UK organisations to take immediate action to address two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell. Krebs on Security and Wired have both confirmed that working exploits exist and are already being used in active attacks, with Amazon Web Services logging exploitation attempts several days before patches became available. The flaws allow attackers to achieve remote code execution, meaning a successful exploit can give an attacker full control over an affected server. PHP underpins an estimated 70 per cent of websites globally, which gives these vulnerabilities an unusually wide potential impact.

Why this matters for UK organisations

Any UK organisation running PHP-based web applications is potentially affected. This includes organisations using popular content management systems such as WordPress, Drupal, Joomla, or Magento, as well as those running custom-built PHP applications for customer portals, e-commerce, or internal tools. The fact that exploitation began before patches were publicly available means that some organisations may already have been targeted without being aware of it. Researchers at The Register note that adversaries have invested considerable effort in refining these exploits, and broad exploitation is now under way. The NCSC's decision to issue formal guidance underlines that this is an active and serious risk for UK businesses, not a theoretical one. Organisations that rely on third-party hosting providers or web development agencies should not assume that patching has been handled on their behalf — that assumption should be verified directly.

What to review

The immediate priority is to confirm the PHP version running across all web-facing systems and verify that the latest patched release has been applied. Organisations should contact hosting providers and managed service partners to confirm patch status if they do not manage their own infrastructure. Web server and application logs from the past seven to ten days should be reviewed for signs of unusual requests or unexpected process execution, given that exploitation predates the patch release. It is also worth confirming that web application firewall rules are up to date and that any temporary mitigations recommended in the NCSC guidance have been applied where patching cannot be completed immediately. Ownership of this review should be clearly assigned to avoid it falling between internal teams and external providers.

Source: NCSC UK