---
title: "PHP2Shell: What the NCSC's PHP Alert Means for UK SMEs, and What to Do This Week"
description: The NCSC says patch PHP, mitigate, or take sites offline. What CVE-2026-109618 and 109619 mean for UK SMEs, five checks for this week, and the ISO 27001 controls that help.
---

[Insights | Cybercontrols](https://www.cybercontrols.io/blog)

# [PHP2Shell: What the NCSC's PHP Alert Means for UK SMEs, and What to Do This Week](https://www.cybercontrols.io/blog/php2shell-what-the-ncscs-php-alert-means-for-uk-smes-and-what-to-do-this-week)

 Written by [Marius van Aswegen](https://www.cybercontrols.io/blog/author/marius-van-aswegen) | Oct 22, 2026, 6:09:29 AM

On Wednesday 21 October 2026, the National Cyber Security Centre published an alert with a line you rarely see in official guidance: if you cannot patch or mitigate quickly, consider taking the system offline until you can. The system in question is PHP, the scripting language that sits behind roughly seven in ten websites. Governments in Finland and the Netherlands did exactly that, and disconnected public sites the same day.

This article explains what happened in plain terms, why it matters more than the usual patch notice, and what a UK SME or scale-up should do this week. It also shows where a working ISO 27001 management system earns its keep, because the organisations coping best with this are not the ones with the most tools. They are the ones that already knew where PHP was running.

## What happened

Two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, were made public on 20 October and fixed on 21 October. Both carry a CVSS v4 score of 9.2. In simple terms, an attacker can send a deliberately oversized web request that pushes PHP into an out-of-memory error. When PHP recovers from that error, it can mishandle what is left in memory, and under the right conditions an attacker can run their own code on the server. No password is needed.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 7.4 to 8.1 are end of life and receive no official release; the PHP security team has published source backports only. Security researchers reported exploitation attempts against honeypots on the day of release, and Cloudflare said it was already seeing early attacks.

## Why this one is different

Three things set PHP2Shell apart from an ordinary patch Tuesday item.

**Reach.** Estimates of exposed systems range from about 1.3 million websites to more than 22 million internet-facing instances. PHP is also bundled inside appliances, content management systems, plugins and supplier platforms, so many organisations are running it without knowing.

**Age.** Cisco Talos estimates that roughly half of internet-facing PHP installations are too old to receive the official fix. For those, the choice is an upgrade project under pressure, a temporary mitigation, or switching the service off.

**Speed.** One of the two discovering firms found the flaws with the help of an AI model, and the details leaked a day before the planned release. Researchers now point out that AI is very good at turning a published patch into a working exploit. The comfortable gap between a fix appearing and attacks starting has, for practical purposes, closed.

## What the NCSC is asking UK organisations to do

The NCSC's priority actions are clear and worth reading in full. In summary:

- Identify every system running PHP, starting with anything internet-facing. Do not limit the search to old versions, because all versions may be affected.
- Update to the latest fixed version, and apply the extra hardening steps published by the PHP team.
- If you cannot update, apply the PHP team's temporary mitigations. If you cannot do that quickly, consider taking the system offline until it is fixed.
- If a system stayed exposed, check it for signs of compromise and backdoors before you bring it back, and use an NCSC-assured incident response provider if you need help.
- Keep watching for updates from software and appliance vendors that bundle PHP.

## Where ISO 27001 actually helps

A certificate does not patch a server. What a working information security management system does is make sure that somebody already knows which servers to patch, who can decide to switch something off, and how quickly. Five Annex A controls do most of the work here.

**A.5.9 Inventory of information and other associated assets.** The first NCSC action is discovery. If your asset register lists the marketing site but not the booking plugin, the supplier portal or the appliance that bundles PHP quietly, your first day is lost to finding things rather than fixing them.

**A.8.8 Management of technical vulnerabilities.** This control expects you to receive advisories, judge exposure and act within a defined timescale. The useful question for this week is not whether you have a patching policy, but whether it contains a route for an emergency that cannot wait for the next maintenance window.

**A.5.19 to A.5.22 Supplier relationships.** Many SMEs do not run their own web servers. If an agency or hosting company does, your contract and your supplier monitoring should tell you how fast they patch, and how they will tell you when they have.

**A.5.24 to A.5.26 Incident management.** Exploitation attempts began within hours. Your incident process should already say who assesses a possible compromise, how evidence is preserved, and when to call for outside help.

**A.5.30 ICT readiness for business continuity.** Taking a website offline is a business decision as much as a technical one. Organisations that have already agreed what a holding page says, who approves it and how customers are told can make that call in minutes.

## A five-point check for this week

1. Ask your IT lead, MSP or web agency for a written list of every system running PHP, internet-facing first, with its version.
2. Confirm each one is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or has the PHP team's mitigations applied. Record the date.
3. For anything on 8.1 or older, agree today whether it is upgraded, mitigated or taken offline. Do not leave it as "in progress".
4. For anything that was exposed, ask for a compromise check before it is treated as safe.
5. Add the lessons to your next management review: how long discovery took, who made the decisions, and what you would change.

## The wider lesson

PHP2Shell will not be the last vulnerability of this kind. As AI shortens the time between disclosure and attack, the organisations that cope will be those whose basic disciplines already work: an asset inventory that is current, a vulnerability process with an emergency lane, suppliers who are held to clear commitments, and leaders who know how to make a fast, documented decision.

That is what ISO 27001 is for. At Cybercontrols we hold ISO 27001 and ISO 42001 certification ourselves, and we help UK organisations build management systems that work on a bad Wednesday, not only on audit day. If you would like a second pair of eyes on your asset inventory or vulnerability process, [get in touch](https://www.cybercontrols.io/contact).

*Sources: NCSC, "Critical security issue affecting PHP" (21 October 2026); PHP security advisory (21 October 2026); Tenable Research FAQ on CVE-2026-109618 and CVE-2026-109619; Cybersecurity Dive (21 October 2026), citing Cisco Talos, Palo Alto Networks Unit 42, Wiz and watchTowr.*

[View full post](https://www.cybercontrols.io/blog/php2shell-what-the-ncscs-php-alert-means-for-uk-smes-and-what-to-do-this-week)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Marius van Aswegen"
  },
  "dateModified" : "2026-10-22T06:34:27.180Z",
  "datePublished" : "2026-10-22T06:09:29Z",
  "headline" : "PHP2Shell: What the NCSC's PHP Alert Means for UK SMEs, and What to Do This Week",
  "image" : {
    "@type" : "ImageObject",
    "height" : 800,
    "url" : "https://144611087.fs1.hubspotusercontent-eu1.net/hubfs/144611087/blog-images/cybercontrols-blog-php2shell-header-1600x800.png",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://www.cybercontrols.io/blog/php2shell-what-the-ncscs-php-alert-means-for-uk-smes-and-what-to-do-this-week",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Insights"
  }
}
```