Two critical vulnerabilities in PHP have sparked urgent patching and precautionary public-sector website shutdowns in the UK and elsewhere in Europe. For WordPress owners, updating the dashboard alone is not enough.
A pair of serious security flaws in PHP has sent website operators racing to apply emergency updates, with some UK public-sector websites temporarily taken offline while administrators assessed the danger. Similar precautions have affected government services elsewhere in Europe.
The fixes arrived on Wednesday, 21 October 2026. Both weaknesses could allow attackers to run malicious code on vulnerable web servers without first signing in. PHP is the server-side language used by WordPress and many other online platforms, putting the issue squarely on the radar of businesses, publishers and hosting companies.
There is a crucial difference between a website being exposed and one being hacked. The patches are urgent, but the precautionary shutdowns do not mean every affected website has been compromised.
Two critical flaws in the PHP runtime
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, sometimes grouped under the name PHP2Shell. Both have a critical CVSS 4.0 score of 9.2 out of 10. They affect PHP itself, rather than a particular WordPress plugin or theme.
One flaw concerns how PHP handles an out-of-memory error. The other can leave internal information accessible after the memory holding it has been released. Security researchers have demonstrated ways these faults can lead to remote code execution.
PHP’s 21 October security advisory identifies internet-facing installations using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as needing attention. It describes the risk as especially serious for Apache mod_php, where a demonstrated attack can begin before the website’s own application code runs.
In practical terms, an application can look fully maintained while the software serving its pages still contains the vulnerability.
Emergency fixes: the PHP versions to look for
The PHP development team released fixes for four supported branches:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Administrators running earlier versions in those branches need an appropriate security update. PHP 8.1 and older are no longer maintained by the main PHP project, although some Linux distributions and commercial long-term support providers offer patched packages for older branches.
That means the number displayed in a hosting control panel may not tell the whole story. A provider can deliver a security backport without changing to the latest upstream PHP release. What matters is confirmation that both vulnerabilities have been fixed in the runtime actually serving the site.
PHP says there is no complete workaround for these flaws. Configuration changes may reduce exposure to particular attack methods, but they do not replace a patched release or a verified vendor fix.
UK public-sector websites taken offline as a precaution
In the UK, Hillingdon Council said it temporarily took its website offline while its supplier investigated a global security issue. Oxfordshire County Council also suspended access to its main website as a precaution. The authorities did not announce that their systems had been successfully hacked.
The UK’s Intellectual Property Office reported a more limited interruption: it temporarily disabled some deposit-account payments while a third-party provider investigated the PHP vulnerabilities. That was not a shutdown of its entire website, and there is no indication that the main GOV.UK platform was taken offline.
The National Cyber Security Centre advised organisations to identify exposed PHP systems, monitor for malicious activity and apply updates. Temporarily taking a service offline can be a safeguard when administrators cannot immediately establish that it is protected.
Update — 23 October 2026, morning: The PHP security emergency has also affected public-safety communications in Japan. Reuters reported on Friday that SoftBank had suspended a mobile emergency-alert service while responding to the vulnerabilities, affecting access to warnings relating to earthquakes, tsunamis and other emergencies. This is a reported service interruption during precautionary security work, not evidence that attackers compromised the alert system. The duration of the suspension and full restoration status have not been independently confirmed. Japan has also announced plans for an AI-assisted cybersecurity testing team as organisations respond to the flaws. The UK NCSC continues to advise organisations to patch vulnerable PHP systems promptly.
Update — 23 October 2026: UK Government confirms wider PHP2Shell disruption
The scale of the PHP2Shell disruption became clearer on Thursday, 22 October, when the UK Government confirmed in the House of Lords that 32 government services were unavailable and another four partially unavailable. These figures describe the position reported to Parliament that day; they do not establish how many services remain offline today.
Technology minister Baroness Lloyd of Effra said the disruption had largely resulted from precautionary measures while departments applied security updates and mitigations. She said officials were working to restore services safely following that work.
The minister also said the National Cyber Security Centre (NCSC) had made 50,000 proactive notifications to the wider economy, advising businesses and other organisations what protective action to take. That figure refers to notifications, not confirmed compromises.
At the time of the statement, the government was not aware of any confirmed compromise of central government systems resulting from these vulnerabilities. Services being taken offline for protection must not be confused with evidence that attackers successfully accessed them.
Millions of attempted exploits reported
Attack activity nevertheless accelerated rapidly after the flaws were disclosed. Reuters reported that Cloudflare had seen millions of exploitation attempts across its network, rising sharply in the hours after the public announcement. Those are attempts, not millions of verified successful intrusions.
Separately, Amazon Threat Intelligence reported an attempted PHP2Shell exploit targeting its MadPot honeypot network on 17 October, four days before disclosure, followed by additional attempts. Amazon said it was unclear whether those attempts would have succeeded against real-world systems.
What website operators should do now
The NCSC’s guidance is to identify PHP installations, prioritise internet-facing systems, monitor for suspicious activity and apply the relevant fixes. Where patching is not immediately possible, operators should assess temporary mitigations and consider taking vulnerable services offline if they cannot be adequately protected. Systems that cannot be promptly patched or disabled should also be checked for possible signs of compromise.
For WordPress owners, the immediate task is still to confirm whether the hosting provider has patched the PHP runtime. Updating WordPress itself, its plugins or its themes cannot repair vulnerabilities inside PHP.
Dutch government services also affected
The Dutch government confirmed on 21 October that it had temporarily taken several public services offline, including Overheid.nl, MijnOverheid.nl and DigiD. Its public notice described the action as precautionary; it did not say those services had been breached.
Reuters reported similar disruption involving public-sector websites elsewhere in Europe as organisations prepared or installed the fixes. The shutdowns underline the potential impact of a vulnerability in software used across many online services, without proving any of those sites was compromised.
WordPress updated? Your PHP might not be
WordPress uses PHP to process pages, operate plugins and handle database requests. A WordPress core update therefore serves a different purpose from a PHP security patch. Keeping plugins and themes current remains important, but those updates alone cannot repair a flaw inside the runtime.
On managed WordPress services, the hosting company may look after PHP and apply vendor backports centrally. That can spare customers a risky manual upgrade, but it also means a site owner may need to ask for confirmation rather than assume the patch is already in place.
GoDaddy has published guidance on the PHP emergency, explaining how owners can check their version and why hosting-provider updates matter. Its public guidance is not evidence that any particular customer’s server has already received the fix.
What website owners should check now
For a WordPress site, open Tools → Site Health → Info → Server. The PHP version is normally listed there, as explained in WordPress’s Site Health documentation. Compare it with the patched releases, then check the hosting provider’s security notice or ask support whether both CVEs are covered by an upstream update or backport.
If the site uses a managed hosting plan, do not switch PHP branches blindly just because an older number appears. Confirm the provider’s update status and check compatibility before any major version change. Owners of self-managed servers should follow their PHP or operating-system vendor’s patch instructions.
Check that usable backups exist, review recent security alerts and logs, and keep WordPress, themes and plugins updated. A web application firewall can be an extra layer, but it is not a substitute for fixing the PHP runtime.
Tech Torque Verdict
The alarm around PHP2Shell is justified. Two critical weaknesses in software used by so many websites deserve a rapid response, and the emergency fixes give administrators a clear route to reducing the risk.
For most WordPress owners, the sensible first move is to establish who maintains the site’s PHP runtime and whether both patches have reached it. Confirm the position with the host if necessary, rather than changing server settings on instinct. Take the threat seriously, but keep the distinction between a security precaution and a confirmed breach firmly in view.
