PHP2Shell: What the Critical PHP Vulnerabilities Mean for Your Business

Does your website, customer portal or booking system run on PHP? If you’re not sure, the answer for most UK businesses is yes, and this week that matters.

On 21 October 2026, the team behind PHP released emergency fixes for two critical security flaws, now known as “PHP2Shell”. Both let an attacker run their own code on a web server without logging in. The UK’s National Cyber Security Centre (NCSC) has told organisations to update straight away, or take vulnerable systems offline until they can.

Here’s what happened, why it matters, and what we’ve already done for you.

What Is PHP2Shell?

PHP is the programming language behind a large share of the web, including WordPress, Drupal, Joomla and many bespoke business applications. If your website lets people fill in a form, log in or buy something, there’s a good chance PHP is doing the work behind the scenes.

PHP2Shell is the nickname for two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity, which puts them firmly in the critical category.

They work in a similar way. An attacker sends specially crafted requests to a website that push PHP into an unusual situation, such as running out of memory part-way through handling a request. PHP is then left holding on to memory it should have cleaned up, and with the right technique, that leftover memory can be used to take control of the server.

In plain terms: no password is needed, nobody has to click anything, and the attacker ends up able to run commands on the server behind your website. From there they could steal data, install malware or use your server to attack other businesses.

Who Found It and How

The flaws were found by security researchers and reported privately to PHP’s security team, so a fix could be built before the details went public. PHP’s own security advisories credit researchers from Calif, Wiz and OpenAI.

Calif started its work on 30 July 2026, as part of OpenAI’s Patch the Planet initiative, which funds security audits of widely used open-source software. Rather than asking an AI model to find “all the bugs”, Calif’s researcher used their knowledge of PHP’s history, including a similar memory problem first found back in 2004, to point AI tools at one specific weak spot: what happens when PHP runs out of memory at exactly the wrong moment. Researchers at Wiz later found the same problems independently.

It’s a clear sign of where cybersecurity is heading. AI is making it faster to find serious flaws in software that has been trusted for decades, for defenders and attackers alike.

The Key Dates

• 30 July 2026: Calif begins its audit of PHP.
• 11 August 2026: The first vulnerability is reported privately to PHP’s security team.
• 15 August 2026: PHP confirms the researchers’ proof-of-concept attack works.
• 21 August 2026: The second vulnerability is reported.
• 20 October 2026: Details leak online ahead of the planned public disclosure on 22 October, so PHP brings its release forward.
• 21 October 2026: PHP releases fixed versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35). The NCSC and the US Cybersecurity and Infrastructure Security Agency (CISA) both issue alerts the same day.

Because the details leaked early, security firms were already reporting attempts to exploit the flaws around the time the fixes were released. Speed mattered.

What We’ve Done for You

Every PHP environment we manage for our partners was patched within 12 hours of PHP releasing its fixes. That covers the websites and applications on our managed hosting, including older PHP versions that PHP itself no longer updates. For those, we applied the security fixes that have been backported to them, so every version we run is protected.

For the services we manage, you don’t need to do anything.

If Your Application Runs on Older Software

Some business applications rely on older software, where a standard update could stop them working properly. We don’t take chances with those.

If that applies to you, your Partner Success Manager will be working with you individually to make sure your application is secured, and to plan a safe route onto supported software so you’re not exposed the next time a flaw like this appears. If you think this might be you and you haven’t heard from us yet, get in touch and we’ll check.

What If Your Website Is Hosted Somewhere Else?

If any of your websites or systems are looked after by someone else, it’s worth asking them three questions this week:

• Are we running PHP, and which version?
• Has it been updated to a fixed version, or patched with a backported fix if it’s an older version?
• When was that done?

If the answer to any of these is “we’re not sure”, treat it as a warning sign. The NCSC’s advice is to update, and where that isn’t possible, to consider taking the system offline until it can be patched.

Why Fast Patching Matters

PHP2Shell is a reminder that the gap between a flaw becoming public and attackers trying to use it is now measured in hours, not weeks. A patch only protects you once it’s actually installed.

That’s why patch management isn’t something to leave to a monthly reminder. Having someone watch for alerts like this one and act on them straight away, backed by ongoing vulnerability management to spot what’s out of date before it becomes a problem, is what keeps a headline like this from becoming your incident.

More Information

If you’d like to read the official guidance for yourself, these are the best places to start:

• PHP’s official security advisory (21 October 2026)
• The NCSC’s alert on the critical PHP security issue
• CISA’s alert: Critical Vulnerabilities in PHP Require Immediate Patching
• The researchers’ own write-up from Calif

Not Sure What’s Running Behind Your Website?

If you don’t know which systems in your business run PHP, or whether a supplier has patched them, we can help you find out. Get in touch with us and we’ll take a look.