On 21 October 2026 the PHP project released fixes for two critical vulnerabilities, known together as PHP2Shell, that can allow an attacker to take control of a web server without logging in. PHP runs a large number of websites, customer portals and internal applications, and it is also built into commercial products that organisations may not think of as PHP systems. The UK National Cyber Security Centre has advised organisations to update affected systems immediately or consider taking them offline. Boards can ask management today for confirmation that the organisation has found its exposure and is acting on it.
What has been disclosed
The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. The first concerns how PHP handles running out of memory. PHP can be interrupted while it is still setting up the data for an incoming web request, and the clean-up that follows can then treat incomplete data as valid. The second concerns data that should be discarded at the end of each request. It can survive after the memory behind it has been released, so a later request handled by the same server process can act on stale information.
In both cases the result is corruption of the server's memory, which an attacker can use to run their own commands on the server. CERT-EU, the cyber security service for EU institutions, rates each vulnerability 9.2 out of 10 for severity. The PHP security team reports that a demonstrated exploit can be triggered by an unauthenticated request before the website's own code runs. Login pages and the application's own security checks therefore offer limited protection against this attack.
Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older versions have reached end of life and receive no updates from the PHP project. However, the project has published minimal fixes in source code form for versions 7.4, 8.0 and 8.1, and some Linux distributions and long-term support vendors provide updated packages.
Why the timeline is compressed
The PHP project announced on 20 October that a security release was coming. Security firm Huntress reports that details of the flaws were posted publicly the same morning, ahead of the planned coordinated disclosure, and that the post was removed after screenshots had circulated. Help Net Security reports that Amazon Threat Intelligence recorded an attempt to exploit the flaw against one of its monitoring systems on 17 October, four days before the fixes were published.
Cloudflare's chief technology officer said the company was seeing early attacks emerging before the patches shipped. CERT-EU notes that technical details and proof-of-concept code are now circulating. Amazon Threat Intelligence now reports that PHP2Shell is being broadly exploited and advises that investigations start from 17 October, the date of the first attempt it recorded. Where attackers have working exploit code on the day a fix is released, the time available to patch internet-facing systems before they are targeted can be measured in hours.
Where the exposure may sit
The vulnerabilities affect PHP installations that handle web requests across the common ways of running PHP on a web server. The PHP security team considers the risk highest where PHP runs inside the Apache web server as a built-in module.
Exposure can extend beyond the systems the organisation's own developers maintain. PHP is built into many content management systems, e-commerce platforms, network appliances, hosting control panels and software sold as a finished product. Hosted websites and services run by suppliers may also depend on it. The NCSC advises organisations to monitor vendors of products that bundle PHP and apply their updates, and the Dutch National Cyber Security Centre has published an inventory of potentially affected products.
The NCSC also warns organisations against limiting their search to older PHP versions, since all versions before the fixed releases are affected.
What the NCSC advises
The NCSC sets out a sequence of priority actions. Organisations should identify their PHP systems, starting with those exposed to the internet, and update to the latest version. Where an update cannot be applied straight away, the PHP project has published temporary mitigations, which CERT-EU and PHP's developers say reduce exposure without fully protecting the system. Where mitigations cannot be applied, or would take too long, the NCSC advises considering taking the system offline.
Systems that could not be updated or taken offline promptly may already have been compromised. The NCSC advises checking them for signs of compromise and for backdoors left by an attacker, and suggests using an NCSC-assured Cyber Incident Response provider where the organisation lacks that capability in-house.
CERT-EU also advises organisations that rely on one widely used volunteer-maintained package repository for PHP to switch to their Linux distribution's packages or build from source, because that repository may not provide same-day updates.
Decisions that may reach the board
Taking a customer-facing website or service offline is a business decision with revenue and reputational consequences, and management may need a fast route to the person authorised to make it. The board can confirm in advance who holds that authority and on what basis they would decide.
If an investigation finds that a system was compromised, regulatory obligations may follow. Under UK GDPR a personal data breach must be reported to the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it. Essential and important entities under NIS2 must submit an early warning of a significant incident to the relevant CSIRT or competent authority without undue delay and in any event within 24 hours of becoming aware of it. Organisations in the UK's existing network and information systems regime have their own reporting duties.
Questions for the board
- Has management identified all internet-facing systems that run PHP, including those operated by suppliers and hosting providers?
- Which of those systems are already updated, which have temporary mitigations in place, and which remain exposed?
- Do any of our systems run PHP 8.1 or older, and how are we obtaining fixes for them?
- Which products and services we buy include PHP, and have their vendors issued updates?
- Who is authorised to take a customer-facing system offline, and has that decision been considered for any system we cannot yet update?
- Have systems that were exposed at any point since 17 October been checked for signs of compromise?
- If a compromise is found, are we ready to meet the reporting deadlines that apply to us?
Where a system cannot be updated or taken offline promptly, a Cyber Risk Decision Review gives the decision owner an independent view of the residual risk, the conditions under which the system could stay in service, and the considerations for accepting that risk.
References
- National Cyber Security Centre, "Critical security issue affecting PHP", 21 October 2026. https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
- CERT-EU, "Critical Vulnerabilities in PHP", Security Advisory 2026-018, 21 October 2026. https://cert.europa.eu/publications/security-advisories/2026-018/
- BleepingComputer, "PHP ships emergency patches for critical PHP2Shell flaws", 21 October 2026.
- Help Net Security, "PHP2Shell: Critical PHP vulnerabilities patched, update now!", 21 October 2026.
- Huntress, "Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)", 20 October 2026, updated 21 October 2026.
- Tenable, "php2shell (CVE-2026-109618, CVE-2026-109619): frequently asked questions about critical PHP remote code execution vulnerabilities", October 2026, citing the PHP security team, Cloudflare, watchTowr and Amazon Threat Intelligence.
- The Hacker News, "Someone tried to exploit PHP2Shell 4 days before the vulnerabilities were publicly disclosed", October 2026.
- W3Techs, "Usage statistics of PHP for websites", October 2026.
- Information Commissioner's Office, "Personal data breaches: a guide".
- European Parliament and Council, Directive (EU) 2022/2555 (NIS2), 14 December 2022.