PHP2Shell: NCSC Warns UK Organisations to Patch PHP Now

On 21 October 2026 the NCSC told UK organisations to take immediate action on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell.

Both can allow unauthenticated remote code execution on web servers running PHP, and the NCSC says organisations using any version of PHP are affected.

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. If you can't patch or apply the temporary mitigations, the NCSC advises considering taking the system offline until it's fixed.

What is PHP2Shell?

PHP2Shell is the name given to two critical vulnerabilities in the core PHP runtime, the server-side scripting language behind a huge share of websites, content management systems, e-commerce platforms and web applications. Both are rated 9.2 under CVSS 4.0.

• CVE-2026-109618: An attacker can push PHP into an out-of-memory condition while it is still setting up a request. The half-built request data is then treated as valid during cleanup, corrupting memory in a way that can be turned into remote code execution.
• CVE-2026-109619: internal state belonging to one request can outlive the memory behind it, so a later request handled by the same worker picks up stale data before it's reset. Again, the result can be remote code execution.

In plain terms, an attacker who can send HTTP requests to your PHP application may be able to run their own commands on the server without logging in. You can read the full NCSC alert here.

Why the NCSC is treating this as urgent

Three things make PHP2Shell more serious than a routine patch cycle:

• It leaked before the fix. Details of both vulnerabilities appeared online on 20 October, ahead of coordinated disclosure, and PHP brought its security release forward to 21 October.
• Attacks started early. Early attack activity was reported on the morning of 21 October, hours before patched versions were published.
• The exposure is enormous. Palo Alto Networks' Unit 42 identified more than 22.6 million internet-exposed instances potentially vulnerable to the two flaws.

It also reaches beyond websites. PHP is embedded in appliances, network devices, management interfaces and other vendor products, where you may not be able to update it yourself.

Which PHP versions are affected?

Every PHP installation that serves web requests is in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk highest for mod_php, where exploitation can happen before your application code even runs.

If you're on PHP 8.1 or earlier, you're running an unsupported version. Given the severity, the PHP project has published minimal source backports for 7.4, 8.0 and 8.1, and some Linux distributions and LTS vendors backport fixes too. The NCSC's advice is still to move to a fully supported version.

Severity ratings can also vary by vendor. Red Hat, for example, rates CVE-2026-109618 as Important for standard RHEL deployments, which use PHP-FPM where exploitation is harder in practice. That isn't a reason to wait. Patch on your vendor's timeline and follow their advisory.

What should UK organisations do now?

The NCSC recommends following vendor best practice and sets out these priority actions:

1. Find every PHP installation, starting with internet-facing systems. Don't limit discovery to outdated versions, because all versions may be affected.
2. Update to the latest fixed version of PHP, and keep monitoring for further updates.
3. Apply PHP's temporary mitigations if you can't update yet.
4. Consider taking the system offline if you can't apply the mitigations, or applying them would take too long.
5. Check for compromise if you can't update or disable the system immediately. Look for evidence of exploitation and backdoors before you remediate, and bring in an NCSC-assured Cyber Incident Response provider if you're not confident doing this in-house.
6. Track third-party vendors whose products bundle PHP, and apply their updates as they land. NCSC-NL maintains an inventory of potentially affected software.

Don't forget the PHP you didn't install

The hardest PHP to patch is the PHP you don't know about. It sits behind marketing websites, WordPress and Magento builds, customer portals, hosted SaaS platforms, firewalls and device management consoles. Ask your hosting provider, web agency and key software suppliers to confirm in writing that they've patched, and add PHP2Shell to your supplier assurance questions this week.

Mitigations are a bridge, not a fix

PHP's temporary mitigations reduce risk by tightening memory and request limits at the PHP and web server or proxy level. They're there to buy time until you can patch. Take the exact settings for your configuration from PHP's advisory, then schedule the upgrade.

What PHP2Shell means for Cyber Essentials, DSPT and DCC

For organisations working with the NHS or the MOD, how you respond is a compliance question as well as a security one.

• Cyber Essentials: critical and high-risk security updates must be installed within 14 days of release, and unsupported software must be removed or kept out of scope. PHP 8.1 and older falls into that second category.
• NHS DSPT: health and care suppliers are expected to evidence supported software and effective vulnerability management. An unpatched, internet-facing PHP application is exactly the kind of finding that surfaces in a penetration test or independent audit. See Does DSPT Require Penetration Testing?
• Defence Cyber Certification (DCC): patching and vulnerability management sit at the heart of the controls assessors check, and testing is expected to confirm it. See our guide to DCC Control 2403.

How Periculo can help

As a CREST-accredited penetration testing provider, Periculo can help you find exposed PHP across your estate, confirm that patches and mitigations have actually taken effect, and test the web applications that sit on top. If you suspect a system has already been compromised, engage an NCSC-assured incident response provider first, then talk to us about validating your fixes.

FAQs

Related reading

• Does DSPT Require Penetration Testing?
• DCC Penetration Testing Requirements: A Complete Guide to Control 2403
• What Is the EU Cyber Resilience Act (CRA)'s 24-Hour Vulnerability Disclosure Rule?