PHP2Shell Exploit: Critical PHP Vulnerability — Patch or Go Offline, UK Cyber Chiefs Warn

Photo: BalticServers.com — Wikimedia Commons (CC BY-SA 3.0). A data centre of the kind at risk from the PHP2Shell flaws (symbolic if illustrative)

Let me be blunt: this is the scariest software bug I have covered in a long time. The language quietly running your council's website, your local BBC programme page, maybe the shop where you ordered dinner last night, has been harbouring two critical flaws for more than a decade. And until yesterday afternoon, nobody had a fix.

On Wednesday, the PHP security team finally pushed emergency patches for what researchers are calling PHP2Shell — a pair of vulnerabilities (CVE-2026-109618 and CVE-2026-109619) rated 9.2 out of 10 — the kind of flaw that lets an attacker run their own code on a server without logging in. Just a crafted web request, and the attacker gets a shell.

Why this one is different

This one lives in the interpreter itself — not one app, but the ground beneath them. As cybersecurity firm Huntress put it in a blog post quoted by Reuters: "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and plenty of software that never advertises it runs PHP under the hood." If your favourite site runs on any of those — and three-quarters of identifiable sites run PHP, per W3Techs — it was exposed.

BuiltWith counts roughly 24 million websites running PHP. Researchers demonstrated working exploits against the latest WordPress, Drupal and Joomla images — and said even a trivial "Hello World" app on a vulnerable version could be hit. They could also silently read server memory, where passwords, tokens and API keys live.

A patch in 12 hours — and a race nobody wanted

The coordinated disclosure was meant to be clean. It wasn't. Details leaked online on Tuesday — a "PHP2Shell" demo video circulating before the fix was even out — and the PHP team pulled the release forward by a full day, shipping patches for PHP 8.2 through 8.5 on Wednesday afternoon.

Here's the twist that made the industry blink: the flaws sat undiscovered for over ten years, and it took artificial intelligence to drag them into the light. Security firms Wiz and Calif located and verified them using OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, then coordinated with the PHP team. The AI age isn't just writing our emails anymore — it's finding the bugs under the internet's floorboards.

Governments pulled the plug

With no complete workaround available — patch or nothing — official bodies went nuclear. Britain's National Cyber Security Centre told organisations: "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated." The US National Security Agency issued an almost identical warning: take systems offline if you can't patch immediately. The EU's CERT-EU and Australia's cyber centre followed suit; Australia said it was not aware of active exploitation, which is the one piece of good news in this whole story.

Then organisations started actually doing it. In the Netherlands, the National Cyber Security Centre took its own site offline, alongside the Port of Rotterdam, the Overheid.nl portal, the KNVB football association and several hospitals. Finland's state IT provider shut down government services; France's Interior Ministry put its sites into preventive maintenance. And here in the UK, Edinburgh Council and several BBC programme pages went dark, according to Computer Weekly — as did systems at the Wikimedia Foundation, which runs Wikipedia. Japan's Prime Minister, Sanae Takaichi, posted on X in the middle of the night urging every website owner to act: "We have an urgent request for everyone to take action tonight."

What this means for you

Here's the practical bit: updating WordPress does not fix this. The flaw is in PHP itself — the thing underneath. Only the server administrator, or your hosting provider, can apply the update. And for older PHP versions — 7.x and below, which still run a huge chunk of the WordPress estate — there is no official patch at all. Site owners are waiting on backported fixes from Linux distributions, and many expect the long tail of unmanaged sites to take months.

So the honest outlook is two-track. Patched and modern: you're fine. Everything else — the forgotten parish council site, the small shop's ordering page, the ancient charity portal — stays a target. When the NCSC says patch or go offline, it is not being dramatic. It's describing the only two options that exist.

Sources

Reuters — "EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities" (21 Oct 2026)

Computer Weekly — "What to do as critical PHP flaws puts millions of websites at risk" (21 Oct 2026, updated)