php2shell is the name vendors use for two critical PHP security flaws, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. PHP is the programming language behind a large share of the web, including WordPress and Wikipedia. The bugs are in PHP itself, not in a theme or plugin. The UK National Cyber Security Centre says they can let an attacker trigger an out-of-memory condition that corrupts memory and, under certain conditions, run code on a server without logging in.

That is why websites went down. Agencies told operators who could not patch immediately to take systems offline. Many did, as a precaution. A site showing an error page is not, by itself, proof it was hacked.

NSA Cyber told organizations using PHP to update, and to take a system offline if an update was not feasible. Updating to a fixed PHP release is the only complete fix the PHP security advisory describes. This page does not include exploit steps.

Quick Answer: What Should You Do?

Install a patched release, restart PHP workers, and confirm the version that is actually serving traffic. If you cannot patch soon, take the exposed system offline until you can.

Versions below those patch levels on 8.2–8.5 are affected. AWS’s bulletin lists 8.5.0–8.5.11, 8.4.0–8.4.26, 8.3.0–8.3.35, and 8.2.0–8.2.34, and says PHP 5.4 through 8.1 have no upstream fix for these issues.

Table of Contents

• Quick Answer: What Should You Do?
• What Is PHP?
• What Happened
• Why Websites Went Down
• Who Is Affected
• What NCSC and NSA Cyber Are Asking
• How to Patch
• If You Cannot Update Today
• After the Upgrade
• Frequently Asked Questions
• Conclusion
• Sources

What Is PHP?

PHP (PHP: Hypertext Preprocessor) is a server-side programming language used to build websites. It runs on the web server, talks to databases, and sends HTML to the browser. Visitors do not install it. If a host’s control panel says “PHP 8.3,” that is the copy that renders the site.

WordPress, many online shops, and parts of Wikipedia run on PHP. A PHP vulnerability is a flaw in that runtime. Patching a WordPress plugin does not fix it. The server’s PHP version has to change.

What Happened

PHP published a security release for two related bugs in how it handles a request when memory allocation fails or a fatal error hits at the wrong moment. The NCSC alert, published 21 October 2026, describes them this way:

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partly initialized. Cleanup may then treat that invalid data as valid.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned state can survive after its memory has been freed. A later request on the same worker may use that stale state before normal startup clears it.

The PHP Foundation says both sit in memory management and error handling, which nearly every request touches. It also says remote code execution was demonstrated against default Apache mod_php settings for the first issue, and that a use-after-free was shown on a real application for the second. Tenable reports that the PHP security team scored both CVSS 4.0 at 9.2, and that Amazon Threat Intelligence saw an exploitation attempt on 17 October 2026, four days before the public advisory. Treat “already exploited” as that reporting, then patch as if it is true.

The informal name in vendor write-ups is php2shell. The CVE numbers are what scanners and tickets should use. BBC News reported that researchers at Calif and Wiz, with OpenAI, found the flaws, and that they had sat in PHP for years. Wiz has estimated that roughly 70% of the internet is affected. The BBC said it could not independently verify that figure. Surrey Centre for Cyber Security professor Alan Woodward told the BBC the flaw reaches on the order of 30 million websites. Use those as attributed estimates, not as a count of confirmed breaches.

Why Websites Went Down

Most October 2026 outages tied to this story are precautionary. The NCSC alert says to take a system offline if you cannot update or apply temporary mitigations quickly. Operators followed that. A down site is often the mitigation, not the attack.

What public reporting actually shows:

Cloudflare is not the outage. On 21 October, Cloudflare said it had deployed web-application-firewall rules for php2shell, including on free WAF plans, about nine hours before public disclosure. Those rules can block some attack traffic. Cloudflare says they do not replace the PHP update. If your host manages PHP, ask them to install the fixed build. A site you own on WordPress is still vulnerable until that PHP version changes.

The same pattern applies in India, the US, and the UK. The CVEs are not country-specific. NCSC guidance is the UK public alert. NSA Cyber is the US public warning. Hosts everywhere else still need the same patched PHP.

Who Is Affected

NCSC’s position is broad: organizations on any PHP version should find their installs and move to a fixed, supported release. Do not skip a box because it is “already on 8.3.” 8.3.35 is still vulnerable. 8.3.36 is the first fixed 8.3 release.

You are in scope if any of these are true:

• A website or API runs on PHP you installed (FPM, mod_php, or a custom build).
• A host, control panel, or container image ships PHP for WordPress, Laravel, Drupal, Magento, or a similar app.
• An appliance, plugin, or SaaS component bundles PHP. NCSC says to watch third-party products, not only php.net tarballs. The Netherlands’ NCSC published an inventory of products with a PHP dependency that may be affected.
• You are on PHP 8.1 or older. Those branches are outside normal security releases. AWS says there is no upstream fix for 5.4–8.1 and that migration to a supported branch is required. A Linux vendor may still ship a backport — check that vendor, and do not assume an old version string is safe because it did not jump to 8.5.12.

Internet-facing PHP should be first. Internal apps are still in scope if an attacker can reach the worker.

What NCSC and NSA Cyber Are Asking

The NCSC alert asks UK organizations to act now. The priority list, shortened:

1. Find PHP across your estate, starting with anything on the internet. Search for PHP in general, not only old versions.
2. Watch vendors that embed PHP, including appliances, and apply their updates as they land.
3. Move to the latest fixed PHP and keep watching for follow-up releases.
4. Apply the extra hardening in the PHP security advisories.
5. If you cannot install a fixed build, use the PHP team’s temporary mitigations.
6. If you cannot apply those either, or it would take too long, take the system offline until it is mitigated.
7. If the system stayed exposed, look for compromise and backdoors before you trust it again. In the UK, NCSC points organizations that need help to an assured incident-response provider.

NSA Cyber posted the same day: every organization using PHP should be prepared for an update covering two critical vulnerabilities, because issues of this kind often lead to the server file system or database. If an immediate update is not feasible, take the system offline until it is fully mitigated. NSA said more specific guidance would follow. Until that note exists, the PHP advisories and the NCSC alert are the concrete instructions.

How to Patch

1. Record the version that answers real traffic: php -v on the host is not enough if the web pool uses a different binary. Check the FPM pool, the container image, and the package the vhost actually loads.
2. Install the fixed package from the same source you already trust: php.net, your Linux distribution, or the platform image (Elastic Beanstalk, Lightsail, a hoster’s PHP selector). AWS said updated Beanstalk platform versions and Amazon Linux packages were rolling out on 21–22 October 2026, and that Lightsail customers must launch from updated blueprints rather than waiting for an in-place OS patch. Confirm those pages before you rely on a date.
3. Restart PHP-FPM, Apache, or the container so old workers die. A package update that leaves workers running is not a patch.
4. Confirm the running version is 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a vendor build that explicitly names both CVEs.
5. Repeat for staging, CLI cron images, and sidecars. One forgotten pool is still a way in.

Read both advisories. The PHP team says the fix for CVE-2026-109618 is not complete unless you also follow the remediation for CVE-2026-109619.

If You Cannot Update Today

The PHP advisory is direct: a release that contains the patch is the only complete mitigation for CVE-2026-109618. Anything else is partial.

For systems that cannot upgrade immediately, the GHSA-w8hw-w9fx-j79w advisory’s primary configuration step is to set and enforce memory_limit=-1, then restart every PHP worker and make sure no pool, directory, or app setting puts a finite limit back. PHP says this is not a complete mitigation: if an underlying allocation still fails, the vulnerable path can still run. Do not treat that setting as permission to stay online.

The same advisory says to keep post_max_size conservative, enforce request size at the reverse proxy, and reduce how much nested input you accept. It also says not to use RLIMIT_AS or RLIMIT_DATA as a substitute memory cap, because those can force the allocation failure this bug mishandles. A container memory limit is not a guaranteed substitute either.

NCSC and NSA Cyber both say the alternative, if mitigations are slow or incomplete, is to take the system offline.

If the host was reachable before you patched, assume it needs a compromise check: unexpected PHP files, new admin users, scheduled tasks, and unfamiliar outbound connections. Scanning for the CVE name is not that check.

After the Upgrade

• Subscribe to your distro’s security feed and to PHP’s release announcements. NCSC expects a patch wave, including products that only bundle PHP.
• Keep the request-size limits you added. They are still useful after the fix.
• Tell hosting customers which PHP selector version is safe, in plain language, if you run shared hosting.
• Revisit end-of-life estates. A one-off backport on PHP 7.4 is not a support plan.

Frequently Asked Questions

What are CVE-2026-109618 and CVE-2026-109619?

They are critical PHP vulnerabilities disclosed on 21 October 2026. Both can corrupt memory when a request hits an out-of-memory or fatal-error path at the wrong time. The PHP project and NCSC say that can lead to unauthenticated remote code execution on a vulnerable web server.

Which PHP versions are fixed?

8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anything older on those branches is affected. PHP 8.1 and earlier have no matching official release; upgrade to a supported branch or install a distributor patch that names these CVEs.

Is WordPress affected?

WordPress itself is not the bug. Any site whose server runs an unpatched PHP version can be affected, including WordPress, Laravel, and other PHP apps. Patch the PHP runtime, including the version your host’s control panel selects.

Does a web application firewall replace the update?

No. Cloudflare deployed WAF rules for php2shell, including on free plans, and says to keep them on while you patch. AWS describes its WAF rules the same way. The PHP advisory says updating is the only complete mitigation.

What is PHP?

PHP is a programming language that runs on a web server and builds the page you see. It is not a browser add-on. WordPress and many other sites depend on it. A PHP security issue is fixed by updating that server software, not by editing a page in the admin.

What is php2shell?

php2shell is the public name for CVE-2026-109618 and CVE-2026-109619, the October 2026 critical PHP flaws. Use the CVE numbers when you scan or open a ticket.

Why are websites down?

Operators were told to take PHP systems offline if they could not patch or mitigate quickly. Wikipedia’s operator, UK councils, NHS Scotland, the Dutch cyber agency, Finland’s public sites, and MSU Federal Credit Union are among those reported to have done that as a precaution. An error page is not proof of a successful cyber attack.

Why did Edinburgh Council, the BBC, or NHS Scotland go offline?

BBC News reported Edinburgh and Oxford council sites went offline and later came back, and that some BBC programme pages were inaccessible without those pages confirming a PHP cause. BBC Newsround reported NHS Scotland took sites down while the flaws were handled. Check each organisation’s own status line for whether it is back.

Is MSUFCU down because of this PHP issue?

CUToday reported MSU Federal Credit Union took its website and digital banking offline as a precaution while it validated systems. The credit union said it had no indication member data was compromised, and that cards, branches, and phone service continued.

What if we cannot patch this week?

Apply the temporary steps in the PHP GitHub advisories, restart PHP workers, and if that will take too long, take the system offline. That is what NCSC and NSA Cyber both recommend. Then check for signs of compromise before you trust the host again.

Were these bugs exploited before the patch?

Tenable reports that Amazon Threat Intelligence observed an exploitation attempt on 17 October 2026, before public disclosure, and that exploitation broadened after the advisory. Patch exposed systems and review them for compromise.

Conclusion

CVE-2026-109618 and CVE-2026-109619 are a same-day patch event for every internet-facing PHP worker, plus anything that quietly ships PHP inside another product. Install 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restart the workers, and confirm the version that serves traffic. Older PHP needs a move to a supported branch, not a hope that “we are not on 8.5.” If you cannot do that promptly, take the system offline.

Follow the NCSC alert, the PHP Foundation note, and the two GitHub advisories. Wait for NSA’s follow-up, and do not wait to patch.

Sources

• NCSC — Critical security issue affecting PHP
• NSA Cyber — public post, 21 October 2026, @NSACyber
• PHP — GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp
• The PHP Foundation — Today’s PHP security release
• AWS — PHP web runtimes bulletin
• NCSC-NL — php2shell product inventory
• Tenable — php2shell FAQ
• BBC News — UK working to identify exposure, What is PHP?, and Newsround
• Cloudflare — WAF protections against php2shell
• Wikimedia — Impact on Wikimedia tools
• CUToday — MSUFCU takes digital banking offline