Actively Exploited PHP Vulnerabilities: What UK Businesses Running Web Applications Need to Know

The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that two critical vulnerabilities in PHP are being actively exploited, adding both to its Known Exploited Vulnerabilities catalogue. As reported by The Hacker News, the flaws — CVE-2026-109618 and CVE-2026-109619 — affect the PHP2Shell component and are both rated 9.2 on the CVSS severity scale. Both enable unauthenticated remote code execution, meaning an attacker with network access to a vulnerable server does not need valid credentials to take control of it. Wired has additionally reported that AI tools were used to assist in discovering these vulnerabilities, and that AI-assisted exploitation followed shortly after public disclosure — significantly compressing the window between vulnerability announcement and active attack. TechCrunch described the episode as a near-miss for a large portion of the internet, given PHP's ubiquity across web infrastructure globally.

Why this matters for UK organisations

PHP underpins a substantial proportion of the web applications, content management systems, and e-commerce platforms in use across UK businesses today. WordPress, Drupal, Magento, and many bespoke web platforms are built on PHP, and a significant number of UK organisations host or operate PHP-based services either directly or through third-party providers. A successful exploit of either vulnerability could give an attacker complete control of the affected server, enabling data exfiltration, ransomware deployment, defacement, or use of the compromised server as a staging point for further attacks within the network. The AI-assisted exploitation angle is also worth noting from a strategic perspective: it suggests that the gap between a vulnerability being disclosed and it being weaponised at scale is narrowing, which places greater pressure on organisations to maintain timely patching disciplines and accurate inventories of their technology stack. Organisations that rely on managed hosting or third-party web platforms are not automatically protected — they need to confirm with their providers that patches have been applied.

What to review

The immediate priority is to identify all PHP installations across your web estate and confirm they are running a version that addresses both CVE-2026-109618 and CVE-2026-109619. If your organisation uses managed hosting, a content delivery platform, or a third-party web development partner, contact them directly to confirm patch status. It is also worth reviewing web application firewall rules and server logs for any unusual activity that may indicate exploitation attempts during the vulnerability window. Longer term, this incident is a useful prompt to review how PHP version management and patching is handled across your environment, and whether responsibility for that process is clearly assigned and regularly tested.

Source: The Hacker News