PHP2Shell: what UK businesses need to do this week

October 27, 2026

Two critical flaws in PHP, the language behind a large share of the world's websites, are now being used in real attacks. If your business runs a website, a customer portal or a web app, there is a fair chance PHP is somewhere underneath it.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and have been nicknamed PHP2Shell. Both are rated 9.2 out of 10 for severity. They let an attacker run their own code on a vulnerable web server without logging in.

Here is what happened, in order:

1. August 2026: researchers at Wiz found the flaws and reported them privately to the PHP security team.
2. 21 October: PHP released fixed versions. The same day, the UK's National Cyber Security Centre (NCSC) told organisations to act immediately.
3. 22 October: proof-of-concept exploit code was public, and security firms were seeing scanning and exploit attempts.
4. 26 October: the US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its list of vulnerabilities known to be exploited in the wild.

The gap between a fix being released and attackers trying to use it was hours, not weeks.

Why this matters if you are a small or mid-sized business

PHP2Shell is a flaw in PHP itself, not in one product. That means WordPress, Drupal and Joomla sites can be exposed if the PHP version underneath them is vulnerable. The PHP project says all installations serving web requests are at risk.

The scale is large. One scan cited by Recorded Future counted more than 4.3 million PHP services online, and around 79% of those showing a version were on branches that no longer get routine updates. Older branches such as PHP 7.4 and 8.1 only received limited source fixes, so many sites cannot simply click "update".

For a smaller business the risk is often hidden. Your website might be run by an agency, a hosting company or an old supplier, and nobody internally knows which PHP version it uses. A compromised server can be used to steal data, host phishing pages under your name, or join a botnet. One security vendor reported a blocked attempt that tried to install a variant of the Mirai botnet malware.

If you are a managed service provider (MSP), multiply that by every client site you look after.

What to do now

The NCSC's advice comes down to six steps. In plain terms:

1. Find every system running PHP. Start with anything facing the internet: websites, portals, booking systems, and appliances that bundle PHP. Don't assume newer systems are safe.
2. Update PHP. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If someone else hosts your site, ask them today which version you are on and when it was patched.
3. Apply the temporary mitigations if you can't update yet. The PHP project has published settings that reduce exposure. They are a stopgap, not a fix.
4. Take it offline if you can't do either. A brochure site being down for a day costs less than a compromised server.
5. Check for signs of compromise. If a system was exposed before patching, look for backdoors before you upgrade. If you are unsure how, use an NCSC-assured incident response provider.
6. Watch for vendor updates. Firewalls, appliances and hosted services that use PHP will need their own patches.

In practice, the hardest step is usually the first one. Many businesses discover websites and test servers they had forgotten about.

Where TrustLayer fits

To be clear, TrustLayer doesn't patch PHP or sit in front of your web server. Patching is the fix, and it has to happen. What TrustLayer does is reduce the knock-on risk while the clean-up happens, and help you keep a tighter grip on the systems around it.

• Web Security protects your people when legitimate websites are compromised and start serving something nasty. New URLs are analysed in real time for malware, and traffic is checked with URL reputation, heuristics and real-time anti-malware scanning, including inside encrypted (HTTPS) traffic.
• Custom block lists let you add domains linked to an attack as soon as security researchers publish them, so users can't reach them from work devices.
• Posture Management continuously checks the configuration of AWS, Azure and GCP environments, where many websites now run. It flags misconfigurations and excessive permissions, which limits how far an attacker can go if one server falls.
• Managed Change Service means TrustLayer engineers can make urgent policy changes for you, with emergency changes targeted within 4 hours, subject to your approval.

TrustLayer is available through BT, MSPs and resellers. If you would like help reviewing your web and cloud exposure, get in touch with the team.