UK assesses exposure as critical PHP flaws trigger global warning
British officials are assessing potential exposure in government online services after critical PHP vulnerabilities prompted international warnings, while Amazon reported exploitation attempts predating public disclosure.
The UK government is assessing potential exposure in its online services after critical vulnerabilities in PHP prompted an international cyber-security response, according to BBC reporting. Governments and businesses face urgent checks as Amazon says attempts to exploit the weaknesses began before their public disclosure. Original BBC report.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, affect software widely used to run websites and applications. Britain's National Cyber Security Centre said the weaknesses could, under certain conditions, allow attackers to execute commands remotely without authentication. NCSC advisory.
PHP operates on servers, generating web content, interacting with databases and handling application logic before a page reaches a visitor's browser. That role makes the response more than a matter of updating individual webpages: organisations must establish where affected PHP installations support their services and who is responsible for maintaining them.
The PHP security team released updates on 21 October 2026, according to a joint European advisory. The European Commission, ENISA, CERT-EU, Europol's European Cybercrime Centre and national incident-response teams urged organisations to identify PHP-based applications, coordinate with hosting providers and prioritise internet-facing systems. European joint statement.
Amazon's threat-intelligence team recorded an exploitation attempt on 17 October through MadPot, its network of decoy systems used to observe malicious activity. The company said the attempt came from an address associated with a commercial anonymisation network, but it remains unclear how the actor obtained information about the vulnerabilities before disclosure.
Further attempts appeared on 21 October before the disclosure embargo lifted, Amazon said. Differences in the attack payloads and anonymisation infrastructure suggested multiple actors were involved, although the company cautioned that its analysis could not establish whether those attempts would have succeeded against real-world systems. Amazon threat-intelligence report.
The distinction between attempted exploitation and a confirmed breach is important. Amazon's observations demonstrate targeting of its sensors, not evidence that customer systems were compromised, while the UK government's exposure assessment does not itself establish that government services were breached.
Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. NHS England's alert notes that PHP 8.1 and older versions are also affected but no longer receive upstream updates, creating an additional migration challenge for organisations still using those releases. NHS England security alert.
The next phase is both remediation and investigation. New Zealand's cyber-security agency has urged affected organisations to apply fixes and investigate unauthorised access, while warning that embedded implementations may require separate vendor-specific updates. Establishing where PHP runs—and whether attackers reached those systems—will therefore remain central to the response. New Zealand NCSC guidance.
Sources
Primary source: BBC Technology. Newzly rewrites and structures source reporting for clarity; verify critical details at the original.