On 21 October 2026, two serious security flaws were found in PHP. PHP is software that runs behind the scenes on a large share of the world's websites, including many built on WordPress and Magento, as well as business applications, storage containers, network and security appliances and management interfaces.
These vulnerabilities, known as ‘PHP2Shell’, are already being actively exploited. This could allow attackers to take control of vulnerable websites and online services without needing a username or password and attempt to steal information, install malicious software, create hidden access or use the affected system to attack others.
A fix has already been released, and The UK's National Cyber Security Centre (NCSC) is urging organisations to install it as soon as possible and check previously exposed systems for signs of attack.
What should I do?
If you don't manage your website or IT systems yourself, please share the steps below from our cyber incident response partner, Control Risks, with your IT provider, website developer or hosting company.
- Find affected systems. Ask technology teams and suppliers which websites, services and applications use PHP, including systems inside the organisation. Detailed information on the vulnerabilities, affected PHP versions and recommended remediation and monitoring actions from Control Risks can be found here (external link).
- Deal with the highest-risk systems first. Prioritise anything reachable from the internet, especially systems using Apache mod_php. Apache mod_php is one common way of running PHP on a web server.
- Install the appropriate update. Use the table below. If a supplier manages PHP as part of an operating system or hosted service, obtain its confirmed security update.
- Restart affected services. This ensures the new software is actually in use.
- Confirm the result. Check the version that each website or application is running; do not rely only on a software inventory.
- Investigate possible earlier access. Review security records for systems that were exposed before they were updated.
Affected and fixed versions
| PHP series | Vulnerable versions | Install this version or later |
|---|---|---|
| 8.5 | Earlier than 8.5.12 | 8.5.12 |
| 8.4 | Earlier than 8.4.27 | 8.4.27 |
| 8.3 | Earlier than 8.3.36 | 8.3.36 |
| 8.2 | Earlier than 8.2.35 | 8.2.35 |
PHP 8.1 and older are no longer supported by the PHP project. Move to a supported version unless a trusted supplier has provided and confirmed an equivalent security fix.
What if I don't know where to start?
Control Risks' recommendation is to seek IT support urgently. Your IT provider or hosting company is often the best first port of call because they can usually see what your website runs on. Where practical, you should also reduce or remove internet access to the affected service, limit the size and type of information it accepts, and disable features identified in the official advisory until the issue has been addressed.
What if I think something's wrong?
Installing the update stops future attacks, but it can't tell you whether anything happened before it was installed. Signs to look out for include:
- Unusual or unusually large requests sent to a website;
- Unexpected crashes, memory problems or repeated restarts of web services;
- Commands or programs started unexpectedly by a web service;
- Unexpected connections from a web server to unfamiliar internet addresses;
- New or changed files, user accounts, scheduled tasks or start-up settings;
- Alerts suggesting hidden web access, stolen credentials or movement to other systems.
What if I believe an attack has been successful?
Treat the matter as a security incident, not just an update task. Follow your incident-response process and:
- Consider disconnecting the affected system from networks while preserving safe access for investigators;
- Preserve relevant records before making destructive changes;
- Check for unexpected programs, files, connections, account activity and hidden access;
- Assess whether passwords, access tokens, digital certificates or other secrets may have been exposed;
- Check connected systems for further suspicious activity;
- Rebuild from a known-good source if the system cannot be trusted;
- Replace credentials and secrets that were, or may reasonably have been, exposed.
If you hold a Hiscox Cyber & Data Insurance policy and believe that you may have suffered a cyber incident, please follow the incident-notification process set out in your policy documentation.
If you need additional guidance, you can find out more at the UK National Cyber Security Centre (NCSC) website here (external link).
