Information correct as of 22 October 2026. This is a fast-moving issue; please check the NCSC links below for the latest position.
What happened?
On 21 October 2026, the developers of PHP released emergency security updates for two critical vulnerabilities, known collectively as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619).
PHP is the programming language behind a large share of the world's websites, including those built on popular platforms such as WordPress, Drupal, Magento and Joomla. It is also built into many commercial software products and online services, so many organisations rely on it without realising.
The flaws allow an attacker to take control of a web server running PHP simply by sending it a specially crafted request. No password or user interaction is needed. Technical details leaked online before the fix was ready, and early attack attempts have already been reported. Several governments and organisations temporarily took websites offline as a precaution while they applied the fix.
The UK's National Cyber Security Centre (NCSC) has issued an alert urging organisations to take immediate action: Critical security issue affecting PHP.
So what?
Your organisation may be exposed in three ways.
- Your own systems. If your website, client portal, intranet or any internal application runs on PHP, it may be vulnerable. An attacker who takes control of the server could alter your website, steal data held in connected databases, install hidden "backdoors" for later use, or use it as a stepping stone into the rest of your network. Older versions of PHP (8.1 and earlier) no longer receive official fixes, which makes them a particular concern.
- Your suppliers and cloud services. Many software-as-a-service (SaaS) platforms, hosted websites, network appliances and off-the-shelf products run PHP behind the scenes. The Dutch NCSC has already listed more than 600 products from around 430 suppliers that may be affected. Fixing these is your supplier's job, but the consequences are yours: a compromise at a supplier that holds your data can quickly become your data breach, with the operational, contractual and regulatory implications that follow.
- Scams exploiting the headlines. High-profile vulnerabilities are routinely used as bait by criminals. Expect emails, texts and calls impersonating IT providers, web hosts, software vendors or even the NCSC, urging recipients to "install an urgent PHP patch", "verify your account" or click a link to "check whether your site is affected". Similar fake-patch campaigns have previously targeted website owners and led to full compromise of their sites. Legitimate vendors very rarely send security patches by email.
What should I do?
Your own systems
- Ask your IT team or managed service provider to identify everywhere PHP is used, starting with anything accessible from the internet.
- Confirm that the security updates have been applied (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or an equivalent fix from your vendor).
- If a system cannot be updated quickly, follow the NCSC's advice: apply the temporary mitigations published by PHP or consider taking the system offline until it can be fixed.
- Check systems that were exposed before they were patched for signs of compromise. Patching closes the door, but it does not remove an intruder who is already inside.
Your suppliers
- Identify the suppliers and cloud services that hold your data or support critical operations.
- Ask them, in writing, whether they are affected, whether they have applied the fixes, and whether they have checked for signs of compromise.
- Watch for security notices from your vendors, and review what your contracts say about how quickly suppliers must notify you of a security incident.
Your people
- Brief staff to treat any unexpected message about PHP or "urgent security patches" with suspicion: do not click links or open attachments, and verify the request through a known contact.
- Make clear that software updates only ever come through your IT team or your vendor's official channels.
- Report suspicious emails to the NCSC by forwarding them to report@phishing.gov.uk.
Useful NCSC resources
How we can help
PHP Compromise Assessment
A straightforward assessment, designed to give you a clear, independent answer on whether your PHP-based systems show any evidence of vulnerability or compromise.
We review the systems you identify as running PHP, check whether the security updates have been applied, and look for indicators that a system was accessed or altered before it was patched. This can run as a standalone piece of work, or as an independent check alongside an assessment you have already carried out internally or through another provider.
Beyond this assessment, our Cyber Risk and Complex Investigations team can also support you with:
- Cyber Security Consulting: rapid exposure assessments of your systems and suppliers, supplier assurance questionnaires, and clear briefings for boards and senior leadership.
- Digital Forensics: compromise assessments of systems that were exposed before patching, with evidence preserved to a standard suitable for legal and regulatory proceedings.
- Incident Response: hands-on support to contain and recover from an attack, working alongside the firm's data protection and regulatory lawyers on notification obligations, including the 72-hour window for notifying the Information Commissioner's Office under UK GDPR.
If you would like an independent compromise assessment of your PHP environment, or simply want expert support determining whether there is any evidence of vulnerability or compromise, please contact us.