Critical PHP Security Issue: What Businesses Need to Know 

Two critical security vulnerabilities affecting PHP, a technology behind many of the websites and web applications organisations use every day, have prompted urgent warnings from cyber security authorities. 

The vulnerabilities, known collectively as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, could allow an unauthenticated attacker to remotely execute code on an affected server. The UK’s National Cyber Security Centre (NCSC) is encouraging organisations to take immediate action, while PHP has released security updates to address the issue.  

For businesses, the important message is that you may rely on PHP without necessarily knowing it, particularly where websites, portals and third-party applications are managed by external providers. 

What is PHP? 

PHP is an open-source programming language that works behind the scenes to power websites and web applications. But PHP isn’t limited to websites. It can also be embedded within appliances, network devices, management interfaces and other third-party products.  

That means your organisation could rely on PHP without directly managing or maintaining it yourself, which is why this issue deserves attention even if you don’t have an in-house web development team. 

What is PHP2Shell? 

PHP2Shell is the name being used for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP itself. 

Both vulnerabilities have been rated 9.2 out of 10 under the CVSS v4.0 scoring system and could allow what’s known as unauthenticated remote code execution.  

Put simply, an attacker could potentially send a specially crafted request to a vulnerable PHP system and execute code without first needing a username, password or other authentication.  

This isn’t an issue with one particular website plugin or application. The vulnerabilities affect PHP itself, so websites, applications and other products that depend on vulnerable PHP versions could potentially be exposed.  

Security updates were released on 21 October 2026, with fixed PHP versions now available.  

Why should businesses pay attention? 

The challenge with vulnerabilities like PHP2Shell is that organisations don’t always have direct visibility of every system or service that relies on the affected technology. 

Your company website may be an obvious place to start, but PHP can also be used within: 

• customer and supplier portals 

• web-based business applications 

• externally hosted websites 

• third-party software and services 

• appliances and other products with PHP embedded within them. 

In many cases, these systems may be managed by a website agency, hosting company, software vendor or another external provider. 

That makes communication with your suppliers particularly important. Just because you don’t manage PHP directly doesn’t necessarily mean no action is required. 

What should businesses do now? 

The first step is to understand whether PHP is being used within your organisation and who is responsible for managing it. 

The NCSC recommends identifying systems running PHP, prioritising those that are internet-facing and applying the appropriate security updates. Organisations should also continue to monitor third-party software providers for relevant updates. 

If your website, hosting, application or other system is managed by a third party, contact the provider responsible and ask them to confirm whether your systems are affected and what action has been taken. 

Five questions to ask your provider 

You don’t need to be a technical expert to start the conversation. Ask your website, hosting or software provider: 

1. Does the service or application use PHP? 

2. Is the PHP version affected by CVE-2026-109618 or CVE-2026-109619? 

3. Has the appropriate security update or vendor-provided security package been applied? 

4. If the system can’t be updated immediately, what temporary mitigations have been applied and when will it be fully updated? 

5. Has the system been checked for any indication that the vulnerabilities have been exploited? 

For systems that cannot be updated or disabled immediately, the NCSC also recommends checking for evidence of compromise before applying the upgrade or mitigation. 

Where an affected system cannot be updated immediately, organisations should follow the temporary mitigations provided by PHP. If neither an update nor temporary mitigations can be applied promptly, the NCSC advises organisations to consider taking the affected system offline until it can be fully mitigated. 

Don’t overlook older systems 

Older websites and applications deserve particular attention. PHP 8.1 and earlier are no longer supported by the PHP project, although some distributions and long-term support vendors may provide their own security packages. PHP has also published source backports for PHP 7.4, 8.0 and 8.1. 

If your organisation relies on an older website, application or appliance, now is a good time to establish what version of PHP it uses and who is responsible for keeping it secure. 

The issue also highlights a wider cyber security challenge. Businesses increasingly rely on websites, applications and technology managed by external suppliers, making it important to understand what you use, who is responsible for maintaining it and how quickly you can respond when vulnerabilities emerge. 

Stay informed and take action 

PHP2Shell is a fast-moving security issue. The priority is to establish whether your organisation is affected and make sure the right people are taking action. 

While Air IT Group does not provide website development or third-party application management services, we recognise the wider cyber security implications of vulnerabilities such as PHP2Shell and the importance of helping organisations understand where action may be required. 

If your organisation operates a website, customer portal or web-based application, contact the provider responsible for it and ask them to confirm whether PHP is used and whether the appropriate security updates have been applied. 

For the latest technical guidance, refer to the NCSC guidance on the critical PHP security issue.