A serious security issue affecting PHP has prompted organisations around the world to take websites offline while they work out what's exposed and how quickly they can apply the fix.
If your business runs a website, online shop, customer portal or business application, you may be wondering whether this affects you.
The short version is simple: find out where PHP is running, prioritise internet-facing systems, apply the latest security update, and get specialist help if you can't confirm that your systems are safe.
The UK's National Cyber Security Centre (NCSC) has warned organisations about two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619, which the security community has nicknamed "PHP2Shell". Under certain conditions, the flaws could allow an unauthenticated attacker to achieve remote code execution on a vulnerable web server. In plain English, that could give an attacker a route to run their own commands on the system.
The issue relates to how PHP handles memory during web requests. That matters to security teams, but most business leaders don't need to understand the underlying code to take the right first step.
What matters is this: PHP is widely used, often sits behind customer-facing websites and isn't always obvious from the outside.
It powers many WordPress websites, online shops, content platforms and other web applications. You may not have chosen PHP directly. It may be part of a hosting package, content management system, third-party application or appliance.
The full scale is still being established.
According to web technology survey W3Techs, PHP runs around 70% of websites whose server-side language can be identified. That's not the same as saying 70% of websites are vulnerable, and nobody yet has a reliable count of how many are exposed.
That's a useful warning against two common mistakes:
The NCSC's advice is broader and more practical: organisations using PHP should identify their systems and update them, because all versions of PHP may be affected. Organisations using older versions are also encouraged to move to a fully supported version.
There are reports of attackers starting to exploit the flaws, although some national cyber security agencies say they haven't yet seen attacks. Either way, a vulnerable system isn't proof that your business has been breached. It's a reason to establish the facts quickly.
The problem isn't just that a patch exists. It's that details of the vulnerabilities became public earlier than planned.
Researchers had been working with PHP maintainers and other organisations on a coordinated release. However, details leaked online the day before the planned release, increasing the risk that attackers could work out how to exploit the flaws before organisations had a chance to patch.
That has led some organisations to take precautionary action while they investigate.
The NCSC says that, where an update can't be applied, organisations should use available temporary mitigations. If those mitigations can't be applied quickly enough, the organisation should consider taking the system offline until it can be fully protected.
That doesn't mean every business should switch off its website immediately. It does mean that leaving an internet-facing system running without understanding its exposure isn't a sensible long-term plan.
Start with an inventory.
Look for:
Don't rely on the website homepage alone. PHP may be running behind the service even when it isn't visible in the site's branding or page content.
If your website is managed by a supplier, ask them to confirm:
Not every system presents the same level of risk.
Start with systems that:
The NCSC specifically recommends prioritising internet-facing systems when identifying PHP installations.
This is where a proper asset inventory earns its keep. If nobody knows what's running, patching becomes a guessing game. And guessing isn't a security control, no matter how confidently it's presented in a spreadsheet.
That's where One2Call's Vulnerability Management service can help: identifying weaknesses, prioritising them based on risk and making sure remediation doesn't disappear into the background once the news cycle has moved on.
The NCSC recommends updating to the latest PHP version with the security fix applied. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, available from php.net.
PHP's official fixes only cover version 8.2 and newer. If you're running an older version, you'll need to upgrade to a supported one, or check whether your hosting provider or operating system vendor has issued its own patch.
Your IT provider, hosting company, web developer or application supplier should confirm the exact update path. Don't assume that upgrading PHP is always a simple click. Older websites can have compatibility issues, unsupported plug-ins or dependencies that need testing first.
That's not an excuse to delay. It's a reason to plan the change properly and record any risk that remains.
If an immediate update isn't possible, ask what temporary mitigation is available, how long it'll stay in place and who has accepted the risk.
If a vulnerable system has been exposed and can't be updated or disabled immediately, it should be assessed for signs of compromise.
If you haven't been able to update or disable a system promptly, the NCSC advises checking for backdoors an attacker may have installed before or during the fix.
That may involve reviewing:
Don't delete evidence before it's been reviewed. If you suspect an incident, bring in the people responsible for investigation and response.
PHP may be included inside another product or service.
The NCSC recommends continuing to monitor third-party vendors, appliances and services that may bundle PHP. It also points organisations towards an inventory of potentially affected products maintained by NCSC-NL, the Dutch national cyber security centre.
This is an important point for businesses that don't manage their own web development. You may have no PHP administrator on the payroll, but you still need to know which supplier owns the risk and how they're handling it.
If you're not sure where to start, ask these five questions:
Ask for the answer in writing. Not because your IT provider is necessarily doing anything wrong, but because security decisions need an audit trail.
If the answers are unclear, One2Call can help you turn those questions into a structured security review, with risks recorded and actions assigned to the right people.
This is where structured vulnerability management can help.
One2Call's Vulnerability Management service is designed to support continuous vulnerability discovery, risk-based prioritisation, remediation tracking and time-bound exceptions. It doesn't replace the work of a web developer or PHP maintainer, but it does make sure critical findings are identified, assigned and followed through rather than lost in somebody's inbox.
If there's evidence that a system may have been compromised, the priority changes from routine patching to coordinated response. Our Incident Response Handling service covers structured triage, containment coordination, evidence capture, stakeholder communication and post-incident actions.
For organisations that need a more joined-up view of risk, Security Governance (vCISO) can help maintain the risk register, oversee controls and turn urgent findings into a prioritised security programme.
Don't panic. Don't assume you're safe because your website is still online. And don't wait for an incident before finding out who's responsible for your public-facing systems.
Ask your IT or security provider to confirm where PHP is running, whether the latest fix has been applied and whether there's any evidence of compromise.
If you can't get a clear answer, that's useful information in itself. It means your business has a gap in asset and vulnerability visibility that needs addressing.
If you're unsure whether your systems are affected, speak to One2Call about a PHP exposure and remediation review, so you can understand the risk, agree the next steps and keep your business moving.