PHP2Shell: what UK small businesses should do now, and how to be ready for the next one

On 21 October 2026 PHP released emergency fixes for two critical flaws that can let an attacker run commands on a web server without logging in. PHP powers WordPress, WooCommerce and many hosting control panels, so a lot of small business websites depend on it. The NCSC and the NSA gave the same advice: update now, and if you cannot, consider taking the system offline. This guide sets out what a small business without a security team should do this week, and how to stay ready for the next one.

What happened

On 20 October, details of two critical PHP flaws appeared online before their planned disclosure. PHP’s security team brought its release forward and published fixed versions on 21 October. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both score 9.2 out of 10 on the CVSS v4 scale.

• What they do. An attacker can push PHP into an out-of-memory state that corrupts its memory. The NCSC says this could, under certain conditions, allow unauthenticated remote code execution.
• What “unauthenticated” means for you. The attacker needs no username or password, only the ability to send a request to your website.
• What the attacker gets. The NSA notes that flaws like these often give a direct path to the server’s files or database: customer records, orders, and the site itself.
• How urgent it is. NCSC-NL reports multiple public proof-of-concept exploits and considers large-scale exploitation likely in the short term.

Why this matters for small businesses

You may be running PHP without knowing it

PHP sits underneath WordPress, WooCommerce, Joomla, Drupal and Magento, and inside many hosting control panels, booking systems and network appliances. The NCSC specifically warns about appliances and services that bundle PHP as a component. The forgotten sites are the risky ones: an old campaign microsite, a staging copy, a supplier portal nobody has logged in to for a year.

Most small firms are not set up for a week like this

According to DSIT, 43% of UK businesses reported a breach or attack in the last year, rising to 46% of small businesses. Only 34% have a policy to apply security updates within 14 days, and only 25% have a formal incident response plan. Among small businesses, continuity plans that cover cyber security fell from 53% to 44%.

Who patches what

Whoever applies the update, the decision to take a site offline and the list of what you run stay with the business. A host can only patch what it knows about.

What to do in the next 72 hours

1. List every website and system that could run PHP. Main site, online shop, old and test sites, booking and client portals, and the admin pages of any network or storage appliances.
2. Ask your host or IT provider, in writing, which PHP version each one runs. You are looking for 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or a supplier backport that includes the fix.
3. If you manage the server, update and restart. Update PHP, then restart the web and PHP services so the fixed version is actually running.
4. Cannot update today? Apply PHP’s temporary mitigations. These include disabling session upload progress (session.upload_progress.enabled=0) and restarting workers. PHP is clear that updating is the only complete fix.
5. Still exposed? Take it offline. A holding page on a separate service costs far less than a compromised server.
6. Check for signs of compromise. Look for unfamiliar files in web folders, new admin accounts, new scheduled tasks and unusual outbound traffic. If you are not confident doing this, the NCSC points to its assured Cyber Incident Response providers.

Sites on PHP 8.1 or earlier are a separate problem. PHP no longer supports them, so plan a move to a supported version rather than relying on workarounds.

Where SME patching goes wrong

Going forward: security on a small budget

This will not be the last emergency patch. In May the NCSC’s Chief Technology Officer warned that artificial intelligence is showing the ability to exploit old software weaknesses “at scale and at pace”, and told organisations to prepare for a wave of urgent updates. His advice is to adopt a policy to “update by default”: apply updates as soon as possible, and automatically where you can. In our view, that is the single most useful habit a small business can build.

Start with what is free

• NCSC Early Warning. Free for any UK organisation. It emails you when your internet addresses show signs of compromise, vulnerable services or open ports.
• NCSC Cyber Action Toolkit. A free, personalised list of actions for sole traders and small firms, building towards Cyber Essentials.
• A free Cyber Advisor session. A 30-minute consultation with an NCSC-assured adviser on how Cyber Essentials applies to you, for firms with fewer than 250 staff that have not held Cyber Essentials before.
• Exercise in a Box. A free NCSC exercise to test how your team would respond to an incident like this one.

Then spend a little: Cyber Essentials

Cyber Essentials covers five technical controls, including applying high-risk and critical security updates within 14 days. Organisations with it are 92% less likely to make a cyber insurance claim, according to the NCSC. Self-assessment costs £320 plus VAT for micro organisations and £440 plus VAT for small ones. Only 5% of UK businesses hold it, so it also marks you out with customers.

Then make it routine

Four questions for your next board meeting or IT review

Where do you stand?

A current list of sites, updates within 14 days and Early Warning in place is a Level 3 (Managed) capability. Tracking patch times and holding Cyber Essentials is Level 4 (Measured). Updating by default, with recovery you have actually tested, is Level 5 (Optimised). Many small businesses sit at Level 2: the host patches, but nobody holds the full picture.

A TrustOps Framework Assessment maps your controls against the model and gives you a costed, sequenced plan sized for a small business. Or start with the free 15-minute assessment.

General information, current as of 21 October 2026. The situation is moving quickly; check the NCSC and PHP advisories for updates. Not legal or regulated compliance advice.