NCSC urges immediate action over critical PHP flaws allowing remote code execution

The alert, published on 21 October, concerns CVE-2026-109618 and CVE-2026-109619, which have been collectively dubbed "php2shell" by security researchers. According to the NCSC, the issues could allow an attacker to trigger an out-of-memory condition in PHP that results in memory corruption, and under certain conditions that corruption could be exploited to achieve remote code execution without authentication.

The first vulnerability arises because out-of-memory handling can interrupt PHP while internal request data is only partially initialised, with request cleanup then treating the invalid data as valid. The second concerns request-owned internal state that survives after its backing memory has been freed, which a later request handled by the same worker may use before normal initialisation resets it.

The NCSC states that organisations using any version of PHP are affected and that all should update to the latest fixed version, with those on older, unsupported releases encouraged to move to a fully supported version. The PHP project released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October.

PHP has said that all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the risk considered highest for mod_php, where an unauthenticated request can trigger exploitation before any application code runs.

The NCSC has set out six priority actions for organisations:

Identify systems running PHP across the infrastructure, prioritising internet-facing systems. Because all versions may be affected, discovery should not be limited to outdated installations.
Update to the latest version of PHP and continue to monitor for future updates.
Where updating is not possible, apply the temporary mitigations published by the PHP Foundation.
Where the temporary mitigations cannot be applied, or would take too long, consider taking the system offline until it can be fully mitigated.
Where a system cannot be updated or disabled immediately, assess it for evidence of compromise and look for backdoors installed by an attacker before upgrading. Organisations not confident in doing this themselves can seek assistance from an NCSC-assured Cyber Incident Response provider.
Continuously monitor for security updates from third-party software vendors, including appliances and services that bundle PHP. The Dutch national cyber security centre, NCSC-NL, has published an inventory of software products with a PHP dependency that may be affected.

The NCSC has said it will continue to monitor for any impact on UK organisations.

The vulnerabilities carry particular significance for data controllers because PHP is the foundation of widely deployed content management systems including WordPress, Drupal and Joomla, as well as numerous customer portals, intranets and line-of-business applications used across the public sector. A successful remote code execution attack on a web server would typically give an attacker access to any personal data the server processes or stores, and to credentials that could enable lateral movement into other systems.

Under Article 32 of the UK GDPR, controllers and processors must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, and the Information Commissioner's Office has repeatedly treated failure to apply available security patches as a breach of that obligation in enforcement action.

Where exploitation results in unauthorised access to personal data, the Article 33 duty to notify the ICO within 72 hours of becoming aware of a breach, where there is a risk to individuals, will be engaged. Public bodies and operators of essential services may face additional reporting duties under the Network and Information Systems Regulations 2018.

The timing of the alert reflects an unusually compressed disclosure. According to the security firm Huntress, details of the flaws leaked on 20 October, a day before the PHP project had intended to release its fixes, and researchers at watchTowr confirmed remote code execution the same day. Help Net Security has reported that Amazon's threat intelligence team recorded an exploitation attempt on its honeypot network on 17 October, four days before public disclosure. Several Dutch organisations, including the House of Representatives and NCSC-NL itself, took websites offline as a precaution on 21 October, according to the e-commerce security firm Sansec.

The NCSC has pointed organisations to its guidance on vulnerability management and preventing lateral movement, to its blog post on preparing for a vulnerability patch wave, and to its free Early Warning service for UK organisations, which provides notifications of potential threats on their networks.

Derek Bedlow

NCSC urges immediate action over critical PHP flaws allowing remote code execution

Jobs

Senior Legal Adviser (General Counsel Advice)

Directory

Events