On Wednesday we wrote about two critical PHP flaws that were due to be fixed that afternoon.
Two days on, the picture has changed. Attackers are now using the flaws, some started before the fixes were even public, and the UK government took dozens of its own online services offline while it patched.
If your business has a website, an online booking system or a customer portal, this is the week to get a clear, written answer from whoever looks after it.
What happened
PHP released fixes on 21 October for two flaws, known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 out of 10. The NCSC says they "may allow attackers to execute commands on any web server running PHP", and that "organisations using any version of PHP are affected".
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (AlmaLinux, Malwarebytes). Hosting companies and Linux distributions are rolling out their own patched packages.
Attacks started fast. According to The Register, Amazon's threat intelligence team detected an exploit attempt on 17 October, four days before the patches shipped, and saw several proof-of-concept exploits from around 02:00 UTC on 21 October.
Cloudflare's chief executive said attempts rose from thousands before disclosure to tens of thousands within 45 minutes, hundreds of thousands within two hours, and have since reached millions. Security firm Hadrian reported the flaws were being "exploited in the wild at scale".
Why the government switched services off
In the House of Lords on 22 October, tech minister Baroness Lloyd of Effra said 32 government services were unavailable and four partly unavailable, mainly as a precaution while updates and mitigations were applied.
The Office for Budget Responsibility took its website offline, and peers raised reported outages at Edinburgh, Oxford, Bristol, Lambeth and Barnet councils. Government sites in Germany, France, Belgium, Finland and the Netherlands were also taken offline as a precaution.
The minister said the government was "not currently aware of any confirmed compromise of central government systems". The NCSC has sent 50,000 warnings to businesses and other organisations.
Switching a site off sounds drastic, but it's exactly what the NCSC recommends if you can't patch or apply mitigations quickly: "consider taking the system offline until it is fully mitigated."
Why updating WordPress isn't enough
The flaws sit in PHP itself, not in a plugin or theme, so sites are at risk whichever content management system they use. As Malwarebytes points out, updating WordPress, Drupal, Joomla or plugins does not update PHP. That job usually falls to your host or whoever manages the server. PHP 8.1 and older no longer receive routine security updates.
What this means for UK small businesses
Plenty of small firms don't know their website runs on PHP, let alone who is responsible for patching it. On shared hosting, your host has probably applied the fix, but you should still confirm it. If an agency or IT provider runs a server for you, someone has to actively do the work.
Because attacks began before the fixes were public, "patched on Wednesday" doesn't mean "safe since Wednesday". Amazon advises investigating suspicious activity back to at least 17 October, and the NCSC says to check systems for signs of compromise before upgrading.
The risk isn't only to your own data. Malwarebytes' Shahak Shalev called the flaws "a goldmine for hackers", warning that attackers could hijack real sites to phish visitors or spread malware. A trusted local business website is exactly the kind of page people click without thinking.
What to do this week
Get the fix confirmed, in writing. Ask your host, agency or IT provider: "Is every site and app we have now on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor-patched build?" You want "installed", not "scheduled".
Find the forgotten sites. The NCSC says to start with internet-facing systems and not to limit the search to outdated PHP versions. Think old campaign microsites, staging sites, booking tools and any device or appliance with a web-based admin page.
If it can't be patched today, take it offline. A few hours of planned downtime is far cheaper than a compromised site. PHP has published temporary mitigations your technical provider can apply in the meantime.
Check for signs of a break-in. Ask your provider to look back to 17 October for unfamiliar files in website folders, new admin users, new scheduled tasks and unexpected redirects. If nobody is confident doing this, the NCSC points to its assured incident response providers, and incidents can be reported at report.ncsc.gov.uk.
Plan your way off old PHP. If anything runs PHP 8.1 or older, agree a date to upgrade it, get a vendor fix, or retire it.
Sophia Says
The striking thing about PHP2Shell is how little time defenders had. Someone was trying exploits four days before the fixes existed, and millions of attempts followed within a day of disclosure. I don't think that's a reason to panic, but it is a reason to stop treating patching as something for next week. The government's response is a good model for a small business too: if you can't fix it today, switch it off for a few hours. A "back soon" page costs far less than a hacked site sending malware to your customers.
This is the moment HackRisk is built for. We look at your business from the outside, the way an attacker does, so you can see which websites and services you have on the internet and spot known weaknesses on them. When the next big advisory lands, you'll already have your list, and you'll know which supplier to call first.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Forgotten websites and services: the Recon Scan maps what your business exposes to the internet, including the old sites nobody remembers.
Unpatched systems: the Vulnerability Scan checks your internet-facing systems for known vulnerabilities, so you can see where updates are still needed.
Hosts, agencies and IT providers: our Supply Chain Risk service helps you keep an eye on the third parties who build and run your website.
Stolen logins after a breach: the Dark Web Scan alerts you if your business's credentials turn up where criminals trade them.
Get your free HackRisk report
Want to know which of your websites are visible from the outside, and whether any need attention? Get your free HackRisk report.