Critical PHP Vulnerabilities: What Businesses Need to Know About PHP2Shell and How to Stay Protected

Two critical vulnerabilities affecting PHP, one of the most widely used technologies behind websites and web applications, have prompted urgent security warnings across the world.

On 21 October 2026, security researchers disclosed two serious vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. The flaws could allow cyber criminals to execute malicious code on affected servers or access sensitive information, potentially putting organisations and their data at risk.

The UK's National Cyber Security Centre (NCSC) has urged organisations to take immediate action, including identifying where PHP is being used, applying security updates and checking for signs of compromise.

But while patching known applications is an important first step, businesses also need to understand where PHP might be operating unnoticed within their wider IT infrastructure.

What is PHP and why is it important?

PHP, which stands for PHP Hypertext Preprocessor, is a server-side scripting language widely used to build websites and web applications.

In simple terms, PHP works behind the scenes to make websites function. It allows applications to process information, communicate with databases, manage user accounts and generate content dynamically.

It is used by popular platforms including WordPress, Drupal and Joomla, as well as countless business applications, customer portals and internal systems.

According to research published by Wiz, PHP powers approximately 70% of websites globally. This widespread use means vulnerabilities within PHP itself can potentially affect a huge number of organisations, regardless of their size or industry.

Importantly, PHP isn't limited to public websites. It can also be embedded within business software, administrative interfaces and other systems that organisations may not immediately associate with web development.

This makes understanding where PHP is used particularly important when responding to vulnerabilities of this scale.

What is PHP2Shell and how does it work?

The PHP2Shell vulnerabilities affect the core PHP engine rather than individual websites or applications built using it.

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involve weaknesses in how PHP manages memory when processing certain requests.

Under specific conditions, an attacker may be able to trigger an out-of-memory error, leaving PHP's internal memory or request information in an unsafe state.

This could potentially lead to two serious security issues:

• Remote code execution (RCE): An attacker could execute malicious commands on an affected server without needing to log in, potentially gaining access to systems or compromising the applications running on them.

• Sensitive information disclosure: Attackers could potentially access information held within server memory, including authentication tokens, passwords or other sensitive data.

One of the most concerning aspects of PHP2Shell is that the vulnerabilities exist within PHP itself. This means even a well-developed and carefully maintained website could be exposed if the underlying PHP installation has not received the appropriate security updates.

Security researchers have also highlighted how artificial intelligence helped uncover and demonstrate the exploitability of these longstanding weaknesses, raising further questions about how quickly previously undiscovered vulnerabilities could become exploitable.

What does PHP2Shell mean for businesses?

For organisations relying on PHP-powered websites, applications or other systems, the potential consequences could be significant.

If successfully exploited, these vulnerabilities could allow attackers to gain unauthorised access, steal sensitive business information, interfere with websites or compromise the underlying infrastructure.

Depending on the systems affected, this could result in operational disruption, financial losses, reputational damage or data protection concerns.

However, the risk is not limited to organisations that knowingly use PHP.

Many businesses rely on third-party platforms, legacy applications and infrastructure that use PHP without it being immediately obvious to their internal IT teams.

For example, a business may have updated its public-facing website but still have older administrative portals, internal dashboards or specialist applications running vulnerable PHP installations.

This creates an important challenge: patching the systems you know about is only part of the solution. You also need to identify the systems you may have overlooked.

Expert insight: Why understanding your PHP attack surface matters

Dom Mortimer, Head of Red Team at WorkNest Secure, highlights the importance of looking beyond the most obvious applications when responding to PHP2Shell.

"The key additional area businesses need to look at is identifying and understanding their current PHP usage. There are vast amounts of portals and applications that use PHP which may not be immediately apparent, including administrative interfaces such as those found in firewall management systems.

Once key applications have been patched, organisations should be looking at internal, unpublished or previously unknown portals and software to understand where PHP is being used and what their wider attack surface looks like."

This is particularly important for organisations with complex IT environments, multiple applications or infrastructure that has developed over several years.

A business might have a clear understanding of its main website and customer-facing services but much less visibility over the technologies supporting internal systems.

Although these applications may not be publicly accessible, they can still present security risks if an attacker gains access to the internal network or finds another route into the environment.

Understanding the full PHP attack surface helps organisations identify overlooked vulnerabilities, prioritise remediation and reduce the risk of leaving critical systems exposed.

What should businesses do to protect themselves?

The NCSC has issued guidance encouraging organisations to act quickly. The following steps can help businesses understand their exposure and take the appropriate action.

1. Identify where PHP is being used

Start by reviewing your IT infrastructure to establish which websites, applications and systems rely on PHP.

This should include public-facing websites, customer portals, internal applications, administrative interfaces and third-party software.

Work with your IT teams, developers and technology providers to identify PHP installations, including those that may not appear in your existing asset inventories.

The priority is to understand your exposure, rather than assuming your business is unaffected because PHP isn't used directly in your main applications.

2. Apply the latest security updates

PHP released security updates on 21 October 2026 to address the vulnerabilities.

Organisations should update affected installations to the latest appropriate fixed and supported PHP release, prioritising internet-facing systems.

Where legacy versions are in use, businesses should consider upgrading to a fully supported version rather than relying on outdated software.

It is also important to review updates from third-party software vendors, particularly where PHP is embedded within applications or infrastructure products.

3. Review internal and less visible applications

Once critical public-facing applications have been addressed, organisations should widen their assessment.

Consider older applications, internal dashboards, unpublished portals and other services that may have been developed or installed without being included in current security reviews.

These systems may be overlooked during routine patching, but they still form part of an organisation's overall attack surface.

Maintaining an accurate inventory of applications and their underlying technologies can help make future vulnerability management more effective.

4. Check for signs of compromise

Applying a security update addresses the vulnerability, but it does not automatically establish whether a system was exploited before the update.

Organisations should review relevant logs, web traffic and system activity for signs of suspicious behaviour, including unusual requests, unexpected changes or unauthorised access.

Where there is reason to suspect compromise, a more detailed security investigation may be necessary.

5. Introduce temporary protections where necessary

Some businesses may be unable to apply updates immediately because of technical dependencies, compatibility concerns or operational requirements.

In these cases, organisations should follow the temporary mitigation guidance provided by the PHP Foundation and their relevant software vendors.

Additional restrictions, monitoring and other security controls may help reduce immediate exposure, but these should not be treated as permanent replacements for patching.

Where adequate mitigations cannot be implemented, temporarily taking an affected system offline may be the safest option.

6. Continue monitoring and testing

Addressing PHP2Shell should not be viewed as a one-off activity.

Regular vulnerability scanning, security assessments and penetration testing can help organisations identify weaknesses across their wider infrastructure and understand whether existing security controls are working as intended.

As new vulnerabilities are discovered, maintaining visibility over applications, dependencies and exposed services makes it easier to respond quickly and effectively.

Why visibility matters just as much as patching

PHP2Shell highlights a wider cyber security challenge facing many organisations: you cannot protect systems you don't know exist.

Businesses often focus on securing their most visible applications, but internal tools, legacy software and third-party systems can introduce risks that are not immediately apparent.

The latest vulnerabilities reinforce why effective vulnerability management requires more than responding to individual security alerts.

It involves understanding your infrastructure, maintaining oversight of the technologies your organisation depends on and regularly reviewing areas where weaknesses could emerge.

By combining timely patching with a clearer understanding of their attack surface, businesses can improve their immediate response to PHP2Shell while strengthening their wider cyber resilience.

Concerned about PHP2Shell? WorkNest Secure can help.

With critical PHP vulnerabilities affecting systems across the world, it's important to understand whether your organisation is exposed and what action may be required.

At WorkNest Secure, our cyber security specialists can help you identify where PHP is being used, assess potentially affected websites and applications, and take the appropriate steps to address vulnerabilities.

Our support includes checking your exposure, helping your team implement updates or temporary mitigations, and reviewing systems for signs of suspicious activity.

Not sure if your business is affected?

We offer a free, no-obligation initial check to help you understand whether your websites and web applications are potentially exposed.

Find out more about our critical PHP security support and speak to our team.