PHP2Shell: What the NCSC's Critical PHP Warning Means for Your Business

On 21 October 2026 the UK's National Cyber Security Centre (NCSC) issued an alert about a critical security issue in PHP, the programming language behind a huge share of the world's websites. The NCSC's advice is unusually blunt: organisations using any version of PHP are affected, and all of them are strongly encouraged to update to the latest fixed version.

If your business has a website, a customer portal, an online shop or any web-based system, there's a good chance PHP is involved somewhere. This post explains what has happened, how to tell whether you're exposed and what to do now.

What is PHP2Shell?

PHP2Shell is the nickname for two related vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both come from the way PHP handles memory when a process runs out of it. Under certain conditions an attacker can use them to corrupt memory and run their own commands on the web server, without logging in.

Each flaw scores 9.2 out of 10 on the industry-standard CVSS severity scale. In practice that means an attacker who finds a vulnerable server can potentially:

• take full control of your website or web application

• steal customer data, payment details or login credentials

• plant malware or ransomware, or use the server to attack other systems on your network

• deface your site or use it to send phishing emails in your name

Why this one is especially serious

A few things make PHP2Shell stand out from the usual run of security patches:

1. It affects every version of PHP. It isn't limited to old or neglected installations, so you can't assume you're safe just because you keep things up to date.

2. Technical details leaked before the fix was ready. Details of the flaws appeared online ahead of the official patch, and early attack attempts have already been reported.

3. PHP is often hidden inside other products. Content management systems such as WordPress, Joomla and Drupal run on PHP, and so do many e-commerce platforms, hosting control panels, intranets, booking systems and network appliances. The Dutch NCSC has published a list of more than 600 products from around 430 suppliers that may be affected.

The response has been dramatic. Public bodies in the UK and across Europe, including the Dutch NCSC itself, took websites offline as a precaution while they patched.

Is my business affected?

You are likely to be affected if you have any of the following:

• a website built on WordPress, Joomla, Drupal, Magento or WooCommerce, or another PHP-based platform

• a web server, VPS or shared hosting account that runs PHP

• a hosting control panel such as cPanel or Plesk

• internal web tools, portals or line-of-business applications built in PHP

• third-party software or appliances that bundle PHP, even if you never see it

If your website is managed by an agency, a hosting provider or a software vendor, don't assume they've dealt with it. Ask them directly.

What the NCSC recommends

The NCSC's guidance boils down to three steps:

1. Find every PHP installation you have, starting with anything that faces the internet. Don't limit the search to older versions, because every version is affected.

2. Update to the latest fixed version. If you're running an old, unsupported version of PHP, move to a fully supported one.

3. If you can't patch straight away, consider taking the system offline until it can be fully fixed.

The NCSC also advises following vendor guidance, because many products bundle their own copy of PHP and will need a patch from the supplier.

Which versions fix the problem?

The PHP project released fixed versions on 21 October 2026:

Two things to note:

• PHP 8.2 reaches end of life on 31 December 2026, so if you're on 8.2, apply the fix now and plan the move to 8.3 or later.

• Some hosting providers and Linux distributions have backported the fix into older PHP packages. If you rely on one of these, check with your provider that the patched package is actually installed.

Your action checklist for this week

• List every website, server and application your business uses that might run PHP.

• Check the PHP version on each one. Your hosting control panel or web developer can tell you.

• Patch to the fixed versions above, or confirm your provider has done it.

• Contact your suppliers (web agency, hosting company, software vendors) and get written confirmation that they've patched.

• Take offline or restrict access to anything you can't patch yet.

• Look for signs of compromise on internet-facing systems, such as unfamiliar files, new admin accounts, unexpected scheduled tasks or unusual outbound traffic.

• Check your backups are recent, working and stored separately, in case you need to restore.

How Britannia IT can help

Vulnerabilities like PHP2Shell are exactly why proactive patching and asset visibility matter. If you're not sure where PHP is running in your business, or you don't have the time to chase every supplier, we can help:

• Exposure assessment: we'll identify your internet-facing systems and find any that are running vulnerable PHP versions.

• Emergency patching: we'll update servers and websites, or put temporary protection in place where a patch isn't yet possible.

• Supplier follow-up: we'll deal with your hosting providers and software vendors on your behalf.

• Compromise checks: we'll look for signs that a vulnerable system has already been targeted.

• Ongoing protection: our managed IT and cyber security services keep your systems patched and monitored, so the next critical warning doesn't become a crisis.

Worried about PHP2Shell? Contact our team today for a free, no-obligation exposure check.

This situation is still developing. For the latest official guidance, see the NCSC's alert. Information in this article was accurate at the time of writing in October 2026.