PHP2Shell: Netcraft Supports U.K. Response with More Than 50,000 Proactive Notifications
Netcraft has issued more than 50,000 proactive notifications as part of the U.K.’s response to PHP2Shell, working with the National Cyber Security Centre (NCSC) to alert website owners and system operators to two critical PHP vulnerabilities and the actions needed to address them.
PHP is a foundational programming language of the internet and has been for over 20 years. PHP even references a Netcraft web survey from 1998 that showed approximately 1% of the internet used it at that point. The language has since ballooned in popularity — Netcraft’s current Web Server Survey data shows that roughly half of active sites on the internet run PHP. Active sites is a measure of websites with distinct content that filters out things such as web-spam. The real percentage is likely to be higher than this due to many web technologies using PHP behind the scenes.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect how PHP handles memory and processes requests. Attackers could exploit them to execute code on affected servers without authentication. PHP released security updates on Oct. 21, 2026, but installations that have not applied the fixes remain at risk.
There is already evidence of exploitation attempts in the wild, which reinforces the need for organizations to act quickly.
Getting urgent guidance to system owners
Organizations need to know where they run affected software, understand their exposure, and reach the people responsible for applying updates. Through the NCSC’s Proactive Notification Service, operators of potentially vulnerable systems are warned about the dangers using externally observable information, such as publicly advertised software versions. The service then contacts relevant organizations with guidance to help them address vulnerabilities. This brings actionable advice directly to system owners who may otherwise be unaware of what they need to investigate.
What organizations should do now
Organizations should identify PHP installations across their infrastructure, prioritize internet-facing systems, and check for third-party products that bundle PHP. The NCSC advises organizations to search for all PHP installations, rather than limit their search to older versions.
Affected firms should urgently install the latest fixed release for the relevant supported PHP branch, or a vendor update that explicitly addresses both vulnerabilities. The initial fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP’s maintainers warn that configuration changes can reduce exposure to specific attack paths, but only an update provides a complete solution. PHP warns that older versions, such as PHP 7.x, have been end-of-life since 2022 and will not be patched.
Where timely patching or temporary mitigation is not possible, the NCSC advises considering taking affected systems offline. Organizations should also investigate signs of compromise — applying a patch does not remove access an attacker may already have established.
