PHP2Shell: two critical flaws in the software behind most websites, and what to ask your web host

PHP is the programming language that runs a large part of the web. The security firm Huntress, quoted by The Register, notes that it powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels and plenty of software that does not advertise that it uses PHP at all. On 21 October the PHP developers released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which together have been named PHP2Shell.

What the flaws do

The NCSC says the issue could allow an attacker to trigger an out of memory condition in PHP that corrupts memory, and that under certain conditions this could be used to run code remotely without logging in. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, The Register reports. The PHP developers said all PHP installations serving web requests are potentially affected, including PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed, and that they consider the risk highest for mod_php. CERT-EU rated both vulnerabilities 9.2.

How seriously it was taken

The NCSC told UK organisations to take immediate action. The Register reported that tech minister Baroness Lloyd of Effra told the House of Lords on 22 October that 32 government services were unavailable and four partly unavailable, largely as a precautionary measure while updates were applied, and that the NCSC had sent 50,000 warnings to businesses and other organisations. She said the government was not aware of any confirmed compromise of central government systems. The same report says AWS found attackers exploiting the flaws four days before they were publicly disclosed. The PHP Foundation told The Register on 23 October that it had no evidence of successful exploitation before disclosure and none on patched versions. Mandiant's chief technology officer said his team had validated some public exploits that could run code against default mod_php deployments but not PHP-FPM.

What the NCSC says to do

The NCSC's priority actions are to find every system running PHP, starting with anything facing the internet, and not to limit the search to old versions, because all versions may be affected. Update to the latest version of PHP. If you cannot update, apply the temporary mitigations the PHP team has published, and if that is not possible or would take too long, consider taking the system offline until it is fixed. If a system could not be updated or disabled straight away, the NCSC says to check it for signs of compromise and for backdoors before the fix goes in. It also says to watch for updates from vendors whose appliances and services bundle PHP as a component.

A third flaw, with a simpler fix

The PHP Foundation has reserved CVE-2026-115560 for a third flaw, The Register reported on 23 October. It says this one needs a very unlikely combination of configuration and application code, and it will be fixed in the next regular release. Until then the PHP advisory suggests setting session.upload_progress.enabled to 0.