NCSC: critical PHP flaws mean unpatched websites should go offline

The UK's National Cyber Security Centre (NCSC) is warning about two critical vulnerabilities in PHP, a programming language widely used across the internet. BBC News reported on the issue on 21 October 2026; the BBC article could not be retrieved, so the facts here are based on NCSC and NHS England notices.

What the flaws are

The PHP team has published a security update. According to the NCSC, the flaw may allow attackers to execute commands on any web server running PHP. The vulnerabilities are CVE-2026-109618 and CVE-2026-109619.

The first concerns out-of-memory handling: PHP can be interrupted while internal request data is only partly initialised, and later cleanup may treat that data as valid. In the second, internal request state can survive after its memory has been freed, and a later request handled by the same worker may use it.

NHS England Digital describes the vulnerabilities as "PHP2Shell". According to that alert, successful exploitation could allow an unauthenticated attacker to execute code remotely or access sensitive data.

NCSC recommendations

The NCSC urges organisations to:

• identify systems running PHP, starting with those exposed to the internet; as all versions may be affected, they should not limit the search to outdated installations,
• monitor vendor updates, including for appliances and services that bundle PHP,
• update to the latest PHP version and apply the additional hardening steps recommended by the PHP team,
• use temporary mitigations if updating is not possible,
• consider taking the system offline until it is fully mitigated if neither an update nor temporary mitigations can be applied.

If a system cannot be updated or disabled immediately, the NCSC advises checking for signs of compromise and for backdoors left by an attacker. Organisations lacking the expertise can turn to an NCSC-assured Cyber Incident Response provider.

NHS Login

The NHS login team said on its developer forum that some partners use PHP. Anyone running an affected version should move to the fixed version as soon as possible.

What it means for readers in the UK

The advice is aimed at website and system administrators rather than ordinary users. It may, however, concern owners of small businesses, online shops and websites that run on PHP (including popular content management systems). It is worth asking your hosting provider or whoever maintains your site whether the update has been applied. Ordinary users do not need to install anything; general precautions such as strong passwords and caution with phishing still apply.