PHP2Shell: NCSC urges UK organisations to update PHP

The National Cyber Security Centre (NCSC) has urged UK organisations to take immediate action over two critical flaws in PHP, the programming language behind much of the web, as security firms report that attackers have begun exploiting them.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, were fixed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project said they "can allow unauthenticated remote code execution", meaning an attacker could run commands on a web server without logging in. Both are rated 9.2 out of 10 on the CVSS v4.0 severity scale.

What the NCSC advised

In an alert published on 21 October, the NCSC told organisations to find every system running PHP, starting with those facing the internet, and to update to the latest version. It said every installation should be assessed, not only older ones.

Where updating is not possible, the NCSC advised applying the temporary mitigations published by the PHP Foundation, or considering taking systems offline. It also advised checking for signs of compromise and monitoring suppliers whose products bundle PHP. The PHP project said "There are no complete mitigations, updating is the only safe choice."

Reports of exploitation

Amazon Threat Intelligence recorded an exploitation attempt against its MadPot honeypot network on 17 October, four days before the flaws were made public, according to Help Net Security and Tenable. Tenable reported that Amazon now describes PHP2Shell as "being broadly exploited in the wild".

Cloudflare's chief technology officer, Dane Knecht, said the company was "seeing early attacks emerging" and had deployed initial firewall rules for sites using its network. Patchstack, a WordPress security company, said hosting partners had reported "multiple active exploitation incidents".

The PHP Foundation said its team "did not identify any functional exploits at the time of release/public disclosure". The NCSC alert does not refer to active exploitation, and the NCSC said it "will continue to monitor for any impact on UK organisations".

Scale

PHP is used by 69.3% of websites whose server-side language is known, according to W3Techs figures cited by Tenable. The security researcher Silas Cutler estimated that more than 1.3 million internet-exposed hosts are potentially vulnerable.

Patchstack said the flaws sit in PHP itself rather than in WordPress, so any site running a vulnerable version of PHP is exposed. Calif, one of the security firms credited with the research, said it had confirmed attacks needing no login against specific versions of applications including WordPress, Drupal, Joomla, Magento and Nextcloud.

The role of AI

The PHP Foundation credited researchers at Calif, OpenAI and Wiz, among others, according to Tenable. Calif and Wiz have both said they used AI models in their research.

Calif's researcher, Ryan Austin, wrote that an AI agent helped him review PHP's source code and trace the flaw, and that the initial discovery used "no special harness, or access to models that weren't generally available".

Wiz said the underlying flaws "had been present for decades" but needed a complex chain of steps to exploit. "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit," it said.

In a May 2025 assessment, the NCSC said the time between disclosure and exploitation "has shrunk to days and AI will almost certainly reduce this further".

Older versions

PHP 8.2 reaches end of life on 31 December 2026. The PHP project has published minimal source fixes for PHP 7.4 to 8.1, which no longer receive official releases. Versions 5.4 to 7.3 receive no fix from the project, according to Tenable.

NCSC urges UK organisations to act on critical PHP flaws as attacks are reported