.svg)
The UK government is investigating potential cybersecurity risks affecting its online services after two critical vulnerabilities were discovered in PHP, a programming language used by websites and online platforms around the world.
The flaws, publicly disclosed on 21 October 2026, have prompted urgent warnings from cybersecurity agencies, governments and technology companies. Security experts warn that vulnerable systems could allow attackers to execute malicious code remotely, potentially exposing sensitive information or disrupting online services.
Criminals Who Refuse to Attend Sentencing Could Face Solitary Confinement or Visit Restrictions
The vulnerabilities, collectively known as PHP2Shell, have been assigned the identifiers CVE-2026-109618 and CVE-2026-109619. Security updates have been released, and organisations have been urged to identify affected systems and install the appropriate fixes without delay.
A UK government spokesperson urged organisations across the public and private sectors, regardless of their size, to follow official cybersecurity guidance.
The UK's National Cyber Security Centre (NCSC) has advised organisations to apply the security updates. Where immediate remediation is not possible, organisations should consider taking vulnerable systems offline until they can be adequately protected.
The incident has drawn attention to the growing role of artificial intelligence in identifying software vulnerabilities and the potential for malicious actors to exploit technical information rapidly.
According to reports, AI-assisted security research helped identify the flaws. Their disclosure has raised concerns about how quickly attackers may be able to develop and use exploits once details of a vulnerability become public.
Technology companies and security researchers have warned that AI could reduce the time required to analyse software weaknesses and develop attack techniques.
She survived a fire that killed her two children. Now she and her partner have been found dead
The incident also highlights the importance of coordinated disclosure, in which researchers, software developers and technology providers work together to address vulnerabilities before technical details become widely available.
However, the discovery of a vulnerability does not automatically mean that every website using the affected technology has been compromised. The actual risk depends on the software version, system configuration and whether the necessary security updates have been applied.
Amazon has reported multiple attempts to exploit the PHP flaws against its systems.
The company's security chief, CJ Moses, said an attempt identified on 17 October targeted a decoy system, known as a honeypot, designed to attract and monitor suspicious activity.
Further attempts were observed on 21 October, according to the company's account. Amazon said the methods and anonymisation techniques varied between the attempts, suggesting that more than one actor may have been involved.
The activity raised questions about how attackers obtained information about the vulnerabilities before the planned public disclosure.
Amazon said it was unclear how the actors became aware of the flaws. The reported attempts demonstrate why security teams are being urged to act quickly rather than wait for evidence that their own systems have been targeted.
PHP is widely used to build dynamic websites and online applications. It supports platforms such as WordPress and is used in many content management systems, online shops and other internet services.
Because the vulnerabilities affect PHP itself, rather than only a particular website application, organisations may need to assess their underlying server software even if their websites appear to be operating normally.
Several organisations and public bodies have temporarily taken websites or services offline as a precaution while assessing their exposure.
Reports have included temporary shutdowns involving public services in Finland and the Netherlands, as well as websites associated with local authorities and other organisations. Some services have subsequently become accessible again.
The Office for Budget Responsibility also said it had taken its website offline in response to the security concerns. Meanwhile, the reported inaccessibility of several BBC programme websites had not been independently confirmed as being linked to the PHP vulnerabilities at the time of the BBC report.
Cybersecurity authorities have stressed that taking an exposed service offline may be appropriate when an organisation cannot apply the necessary protection immediately.
Security advisories warn that successful exploitation could allow an unauthenticated attacker to execute code remotely on an affected server or gain access to sensitive information.
Depending on the system and the level of access obtained, this could create risks involving website data, server operations and connected services. Organisations may also need to investigate whether any attempted attacks succeeded before security updates were installed.
The vulnerabilities affect multiple PHP versions. Security fixes have been released for supported branches, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators should consult the official PHP advisory and their software or hosting provider to confirm the appropriate update for their environment.
Simply updating a website's content management system may not resolve a vulnerability in the underlying PHP runtime. Website owners should therefore confirm that the server itself is running a patched version.
Cybersecurity agencies are urging organisations to identify all systems running PHP, prioritise services accessible from the internet and apply the relevant security updates.
Businesses and public bodies that cannot immediately secure vulnerable systems should assess whether those services need to be temporarily isolated or taken offline.
Website administrators should also review security logs and monitor for suspicious activity, particularly where systems may have remained exposed after details of the vulnerabilities became public.
The incident illustrates the challenges organisations face as software vulnerabilities, AI-assisted research and increasingly rapid exploitation attempts reshape the cybersecurity landscape.
For governments, businesses and website operators, the immediate priority is to establish whether their systems are affected, apply the available fixes and investigate any signs of compromise.
