PHP2Shell EXPLOIT: Is your website one of the up-to 70% at risk?

The National Cyber Security Centre (NCSC) has issued an urgent warning to UK businesses following the discovery of two critical security vulnerabilities, collectively known as PHP2Shell, affecting technology used by almost 70% of websites worldwide. 

The vulnerabilities could allow cyber criminals to gain unauthorised access to vulnerable website servers, potentially exposing customer information, compromising business systems and causing significant disruption. 

The seriousness of PHP2Shell has already resulted in major websites being temporarily taken offline around the world, including government departments, healthcare services and educational institutions, as a safety precaution. 

With businesses increasingly relying on their websites for customer enquiries, online sales and everyday operations, understanding whether your website could be affected is essential. 

 

What Is PHP2Shell? 

PHP2Shell is the name given to two newly discovered security vulnerabilities affecting PHP, a widely used technology that helps websites and web applications function. 

While most business owners and marketing teams may never have heard of PHP, there is a good chance their company website relies on it. 

PHP is used behind the scenes to power many familiar website platforms, including WordPress, Drupal and Joomla. It helps websites process contact forms, manage customer accounts, display content and connect to databases. 

The newly discovered vulnerabilities, officially identified as CVE-2026-109618 and CVE-2026-109619, have both received a critical severity rating of 9.2 out of 10. 

In simple terms, PHP2Shell could allow an attacker to send specially crafted requests to a vulnerable website and potentially gain control of the server running it, without needing a password or authorised access. 

This makes the vulnerabilities particularly concerning, especially for businesses with customer-facing websites, online stores or applications containing sensitive information. 

 

Could PHP2Shell Affect 70% of Websites Worldwide? 

The potential scale of PHP2Shell is enormous. 

According to W3Techs, as of 21 October 2026, PHP is used by approximately 69.3% of websites where the server-side programming language is known. 

This means that up to 70% of websites could potentially be exposed to risks associated with PHP2Shell, depending on their software versions, configurations and whether the latest security updates have been applied. 

However, this does not mean 70% of websites have been compromised or are necessarily vulnerable. The figure highlights how widely PHP is used and the potential reach of these security issues. 

For UK businesses, the important question isn’t how many websites worldwide could be affected, but whether their own website is properly protected. 

 

Why Are Major Websites Being Taken Offline? 

On 21 October 2026, numerous websites and online services were temporarily taken offline as organisations responded to the PHP2Shell security threat. 

According to Reuters, affected services included government websites in Germany, France, Finland and the Czech Republic, alongside hospital websites and other major services in the Netherlands. 

Many of these shutdowns were precautionary, allowing technical teams to install security updates before restoring public access. 

This is an important distinction. A website being taken offline does not necessarily mean it has been hacked. In many cases, it represents a proactive decision to protect systems and information. 

The NCSC has advised businesses that cannot immediately secure affected systems to consider temporarily taking them offline until appropriate security measures can be implemented. 

 

What Does PHP2Shell Mean for Your Business? 

For many businesses, their website is much more than an online brochure. It is an important sales channel, marketing platform and point of contact for customers. 

Whether your website generates enquiries, processes orders, manages bookings or provides customer access to services, a security vulnerability could have significant consequences. 

Customer and Business Data at Risk 

A successful attack could potentially expose confidential information, including customer details, business records or information held within connected databases. 

For businesses handling personal information, this could also introduce data protection and regulatory concerns. 

Website Downtime and Lost Revenue 

If your website becomes compromised or needs to be taken offline, customers may be unable to make purchases, submit enquiries or access essential services. 

For businesses relying on their online presence, even relatively short periods of disruption could result in lost opportunities and revenue. 

Damage to Customer Trust 

A compromised website could potentially be used to distribute malicious content, redirect visitors or expose sensitive information. 

Beyond the immediate technical and financial consequences, an incident could damage customer confidence in your business. 

Wider Cyber Security Risks 

If cyber criminals gain access to a vulnerable web server, they could potentially install malware, steal information or attempt to access other connected systems. 

What initially appears to be a website security issue could therefore develop into a much larger cyber security incident. 

 

Does PHP2Shell Affect WordPress Websites? 

If your business uses WordPress, PHP2Shell is something you should be taking seriously. 

WordPress is built using PHP, meaning the security of the underlying PHP installation is an important part of protecting your website. 

However, using WordPress does not automatically mean your website is vulnerable. 

The level of risk depends on factors including the PHP version running on your server, whether the necessary security updates have been installed and how your website is hosted. 

Importantly, updating WordPress plugins or themes alone will not resolve PHP2Shell. The underlying PHP software also needs to be secured. 

If your website is managed by an external developer, marketing agency or hosting provider, you should contact them to confirm that the necessary checks and updates have been completed. 

 

What Should Businesses Do About PHP2Shell? 

The NCSC is recommending that UK businesses act immediately to identify potentially affected systems and ensure the latest security updates have been applied. 

For business owners, senior leaders and marketing teams, this doesn’t necessarily mean making technical changes themselves. However, it does mean ensuring that whoever manages your website is taking appropriate action. 

Start by confirming whether your business website or online applications use PHP. If they do, ask your website manager, developer or hosting provider whether the PHP2Shell security updates have been applied. 

The PHP development team released fixed versions on 21 October 2026, including PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Businesses running older, unsupported versions should seek advice about upgrading or obtaining supported security fixes. 

Businesses should also ensure that website backups are available, security monitoring is in place and any unusual activity is investigated. 

If updates cannot be applied immediately, the NCSC recommends following appropriate temporary security measures or considering taking vulnerable systems offline until they can be secured. 

Even if your website appears to be working normally, this does not necessarily mean it is protected. 

 

Is Your Business Website Vulnerable to PHP2Shell? 

PHP2Shell is a timely reminder that cyber security is not just an IT responsibility. It is a business priority. 

From website downtime and lost enquiries to customer data breaches and reputational damage, the consequences of an unaddressed security vulnerability can affect businesses of every size. 

At TwentyFour IT Services, we help businesses identify cyber security risks, manage vulnerabilities and implement proactive security measures to protect their systems, information and operations. 

 

Not sure whether your business website could be affected by PHP2Shell? 

We’ve made a FREE Vulnerability Checker available to help you take the first step towards identifying potential website security risks. 

 

 

An initial vulnerability check can help identify potential risks, but it does not replace a full technical assessment or confirm that PHP2Shell has been completely mitigated. 

Enquire Here