The official National Cyber Security Centre (NCSC) is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP. As the NCSC states, PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.
PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user’s browser. PHP is also used in a range of other products.
The security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed. If you’re in the UK, you can sign up to the free NCSC Early Warning service to receive notifications of potential threats on your network.
Comments
VimalRaj Sampathkumar, Regional Technical Head – UK and Ireland, at the IT management product company ManageEngine says:ย โConsidering the intensity of the vulnerability, organisations that took their websites offline this week have definitely made the right call. This stands as a testament to show how much resilience depends on proactiveness, and preparation.
“When a flaw surfaces in software that powers much of the web, for many organisations, the hardest part wouldn’t be the fix itself, but locating every system that needs it, including the forgotten sites and older tools that can quietly carry the most risk. The organisations best placed to respond know what software theyโre running, where it lives, which services depend on it, and who is responsible for coordinating updates across internal teams and external providers.
“This most likely wonโt be the last vulnerability at this scale, especially as AI speeds up how quickly flaws are discovered. For IT and business leaders, clear responsibilities and rehearsed response procedures can help turn a critical advisory into coordinated action, including informed decisions about whether services can continue safely while updates are applied.”
Chris Wysopal, Co-Founder and Chief Security Evangelist at Veracode said: “What makes this especially dangerous is that the vulnerabilities are in PHP itself, below the application layer. An organization could have done everything right to secure its application code and still be exposed. Researchers demonstrated that attackers could potentially compromise a server without authentication, or steal sensitive information directly from memory, even when the application code is secure. This is a reminder that software security must extend through the entire technology stack, not just the code developers write.”
And Niv Lanyado, JFrog Security Research team lead, said:ย “One thing organizations must keep in mind with PHP2Shell is that because this flaw triggers inside the core PHP engine before any application code executes, traditional application-level safeguards won’t stop it. Organizations cannot rely on code-level workarounds; automated visibility across all environments โ especially identifying legacy or end-of-life PHP installations that won’t receive vendor binary updates โ is essential to ensuring every endpoint is patched or isolated immediately.”
Oliver Simonnet, Lead Cybersecurity Researcher at CultureAI said:ย “PHP2Shell is a clear example of how little time we now have as defenders to secure our environments in the age of AI. In a world where these types of vulnerability discoveries may become commonplace, and details being leaked before formal disclosure, exploits created exceptionally fast, and attackers exploiting the issue in the wild rapidly before fixes are even available. It’s almost impossible to justify a traditional maintenance window in this situation and what can you do if you know for a fact you’re vulnerable and you need to decide if you even can apply a temporary mitigation, or need take exposed systems offline. Its a nightmare scenario for security teams.
“AI may play a part in making this worse as it helps attackers develop exploits faster, but its also what gives us the power to discover these issues so they can finally be fixed. So the challenge is now to arrive at a balance where we have the capability to not only identify exposed systems, but also develop effective mitigations and get them deployed before active exploitation can cause these types of disruptions.”
