On 21 October 2026, PHP project released fixes for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. The vulnerabilities meant attackers could run code on a web server without logging in. Exploitation attempts were reported as early as 17 October, four days before the patch. The NCSC advises UK organisation to identify every system running PHP and update it immediately. The vulnerabilities sit in PHP and affect every app built on it, which includes WordPress, Drupal, Joomla and bespoke systems.
News of the PHP cyber attack was acted on immediately by Citation ISO. We took down all potentially exposed sites as a precaution and are bringing each one back online as it’s patched. Some of our Group websites run on older versions of PHP, so they’re taking a little longer.
Citation ISO and Atlas have been restored to full working effect, however, if you are experiencing any disruptions, please do not hesitate to let us know.
Check your external exposure
Cyber Protect includes external vulnerability scanning on the Cyber Atlas platform. It identifies internet-facing systems, detects known CVEs, including CVE-2026-109618 and CVE-2026-109619, and provides remediation guidance. Find out more about Cyber Protect or speak to the Citation Cyber team.
For more in depth knowledge about the PHP vulnerabilities, you can read more on this link: