PHP2Shell Forces UK Government Services Offline

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, have left 32 UK government services unavailable and four partly disrupted, according to the minister's statement in the House of Lords. Several European governments and Australia's cybersecurity agency also took sites offline as a precaution, and no compromise has been confirmed.

5 effects · 3 potentially affected companies · The full cascade analysis is part of the Pro plan. Create free account

PHP2Shell, two unauthenticated remote code execution flaws in PHP, forced precautionary shutdowns of public-sector sites across the UK and several other countries. The flaws were found with AI tools (OpenAI's GPT-5.6 Sol and Wiz's tooling), and AWS says attackers were exploiting them four days before disclosure. That points to shrinking patch windows and rising demand for emergency patching, web application firewalls and exposure management. Cloud and edge security providers such as Cloudflare and AWS are positioned to benefit from mitigation demand. In the UK, the disruption adds pressure on the Cyber Security and Resilience Bill, which currently leaves central government and councils outside its statutory duties.