Whitehall Pulled 32 Services Offline Over PHP2Shell. Would You Know Which of Your Sites to Pull?

01 What the government said, and what it did not

The public record is two statements and an NCSC alert. Here is what each one says, attributed. Where a figure comes from a single politician’s claim, the table says so.

The OpenAI link explains the speed. Researcher Ryan Austin at the security firm Calif found one of the flaws in August using an OpenAI model, according to the Wall Street Journal as reported by PA [ PA / LBC ] . The Register names the model as GPT-5.6 Sol, and reports that Google’s Wiz found both flaws separately with its own AI tools [ The Register ] . The government had a week’s notice and set up a cross-departmental response before the details went public.

The UK was not alone. Germany, France, Belgium, Finland and the Netherlands took government websites offline as a precaution, and so did Australia’s cyber security agency. Ollie Whitehouse, the NCSC’s chief technology officer, put it this way: “We’re in an era now of digital dependency, coupled with heightened cyber threat.”

02 Why “take it offline” was the right call

PHP2Shell lets an attacker run code on a web server with one crafted request and no login. The PHP project rates both flaws 9.2 on CVSS v4.0 and lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as affected setups. It rates the risk highest for mod_php [ php.net ] .

The attacks came first. AWS says attackers were exploiting the flaws four days before public disclosure, and Cloudflare has recorded millions of attempts since [ The Register ] . A department that waited for a maintenance window would have been patching a server somebody else already controlled.

So the NCSC’s order of operations is blunt. Find every PHP install, internet-facing first. Update. If you cannot update, apply the PHP project’s temporary mitigations. If you cannot do that quickly, consider taking the system offline. If you cannot update or switch it off at once, check it for signs of compromise and backdoors first [ NCSC ] .

Taking a site down for a day costs a business some enquiries. A web shell on the server that also holds your customer database costs a lot more: a forensic investigation, a possible report to the ICO within 72 hours, and letters to customers. Whitehall chose the outage. You get to make the same choice only if you know which sites to pull.

03 Find every PHP site you own

PHP runs most of the web. Cloudflare puts it behind almost 70% of websites [ PA / LBC ] . Shodan counts about 2.24 million internet-facing hosts that advertise PHP. Of the 1.5 million that report a version, 59% run a branch with no official fix coming [ CybelAngel ] . WordPress.org’s own figures put 35.1% of WordPress sites on a PHP version the project no longer supports, 16.46% of them on PHP 7.4.

A UK business with 40 staff rarely has one website. It has the main site, plus whatever was built around it over ten years. Walk through this list and write down every entry that exists for you:

1. The main website. WordPress, Drupal, Joomla and most UK agency builds run on PHP.
2. The shop. WooCommerce, Magento and OpenCart are all PHP.
3. Old campaign and microsites. The 2021 product launch, the event page, the recruitment site. Nobody updates them because nobody remembers them.
4. Staging and test copies. Agencies often leave a staging.yourcompany.co.uk running with a copy of the live database.
5. Client portals, booking and forms. Appointment booking, quote forms, file upload portals and intranets are often PHP applications.
6. Boxes you never think of as websites. The NCSC warns that appliances and services can bundle PHP, and points to an inventory of affected products kept by NCSC-NL [ NCSC ] . Firewall admin pages, NAS boxes, phone systems and helpdesk tools are worth checking against it.

For each entry, you need three facts: the address, who runs the server, and the PHP version. Your domain registrar shows every domain you own, and your DNS records show every subdomain pointing somewhere. Many servers announce PHP in an X-Powered-By response header, though plenty hide it, so a missing header proves nothing. The person with server access can run php -v in a minute.

One trap on version numbers. Ubuntu, Debian and Red Hat backport security fixes into their own packages without changing the upstream version. A patched server can report PHP 8.1 and be fixed; another reports 8.3.30 and is wide open. Check the package version against your Linux vendor’s advisory, not the number alone.

04 Six questions for your host or web agency

Most UK small businesses do not run their own web servers. A host, an agency or a freelancer does. Send them these six questions by email today, and ask for an answer per site. A phone call gives you comfort. An email gives you a record.

1. Which PHP version does each of my sites run? List every domain and subdomain, including staging.
2. Is the fixed build installed? That means 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the patched package from your Linux vendor. On shared hosting, ask for the platform’s published notice.
3. Were the PHP workers restarted, and when? A patch on disk does nothing until the running processes reload it.
4. Which of my sites run PHP 8.1 or older? Those get no official release. Ask for the upgrade plan and the date.
5. Have you checked for signs of compromise since 17 October? New admin accounts, unfamiliar PHP files in upload folders, changed files and odd outbound connections. The NCSC asks for this check on any system that stayed exposed.
6. If a site cannot be patched this week, will you take it offline or restrict it? Agree the answer before the incident, not during it.

05 If you cannot patch today

The PHP project says it plainly: updating is the only complete fix [ php.net ] . If your host needs a few days, or the site runs on a branch with no release, you have three options, in this order.

Take it offline or restrict it. This is what Whitehall did. Put up a holding page, or limit access to your office IP addresses or a VPN. For a brochure site, a day offline costs very little.

Apply the interim mitigations. The PHP project lists partial fixes for each flaw. For CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini or the FPM pool and restart every worker; on PHP 8.5, also set fatal_error_backtraces=0. For CVE-2026-109618, set a low post_max_size, enforce request size limits at the web server, and set memory_limit=-1 paired with a container or cgroup limit. Settings in .user.ini or ini_set() do not work. The PHP project says these reduce exposure and do not make the server safe.

Put a web application firewall in front. Several providers shipped firewall rules within hours. Treat them as a stopgap. A WAF filters known request patterns; a patched PHP build removes the bug.

Then plan the upgrade you have been putting off. PHP 8.2 reaches end of life on 31 December 2026. A site on 8.2 today is ten weeks from being in the same position as the 7.4 sites now stuck without a fix. Our global team has the technical detail on both flaws and the exploitation timeline in its PHP2Shell analysis [ Red Team Partners ] .

The NCSC says this will not be the last flaw of its kind. AI tools found these two, and the same tools are pointed at other software now. The next alert will ask the same first question as this one: where does it run? The 32 services Whitehall switched off were on a list someone had already written. If you start yours this afternoon, you will have it when the next alert lands.