PHP2Shell: what GP practices need to know about the PHP website vulnerability

What PHP2Shell is

On 21 October 2026 the PHP project published fixes for two flaws, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both are rated critical. They let someone send a specially made request to a website and run their own code on the server behind it, or read data the server is holding in memory. They don’t need a login, and a security plugin or a strong admin password won’t stop them, because the attack happens before the website’s own software runs.

The same day, NHS England’s Cyber Security Operations Centre issued a high severity alert, CC-4875, and the NCSC published its own warning. Researchers have shown working attacks against WordPress, Drupal and Joomla, and NHS England expects attacks to follow. Regional teams then asked practices to pass the alert to whoever runs their website and get two answers back: whether anything has been affected or switched off, and whether the fix is in place.

Which websites are affected

Any website that runs on PHP and hasn’t been updated. That includes:

• sites built on WordPress, Drupal or Joomla, which many practice websites are;
• many other website systems and practice website products, whether or not they name PHP;
• sites on shared hosting, where your supplier’s host runs PHP for many websites at once.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later. PHP 8.1 and older no longer get updates as standard, and NHS England’s alert says sites on them should move to a supported version. Updating PHP is the only complete fix.

What it could mean for your practice

Your clinical system and NHSmail don’t run on your website, so they aren’t at risk through it. The risk is to the website itself, and to anything patients type into it. Someone who takes over the site could:

• change your phone number, opening times or urgent care advice;
• post a false closure notice, or add pages asking patients to pay or “confirm their NHS details”;
• read what patients send through forms on the site, such as contact, registration or repeat prescription forms, if those are handled by the website itself;
• take admin passwords, or use your site to attack others in your practice’s name.

If your supplier has to take the site offline to fix it, patients lose your phone numbers, opening hours and links to online consultation until it’s back. Ask how long that would be, and keep your NHS.uk profile up to date as a fallback.

What to ask your supplier

Ask in writing, so you have their answers if your ICB or NHS England follows up:

1. Does our website run on PHP? If the answer is no, the rest of this list doesn’t apply.
2. Which PHP version is it on now, and when was it updated? Look for 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, and a date.
3. Is anything still on PHP 8.1 or older? If so, ask for a date to move it.
4. Have you checked for signs that someone got in before the fix? Attack attempts were seen before the fixes came out, so updating alone isn’t proof. Look for checks on new admin accounts, changed files and unusual requests in the logs.
5. Was the site switched off, or did patients notice anything? You’ll need this for NHS England’s first question.
6. Do forms on our site store or email what patients send? If they do and the site was reached, that data may have been exposed.

A good answer comes the same day, covers every point, and doesn’t need you to do anything technical. Our guide to checking your website’s security has more questions to ask about how they keep your site safe day to day.

If your supplier hasn’t answered

• Chase them in writing, and ask for a time by which the fix will be in place.
• Check your site yourself: your homepage, phone numbers, opening times, closure notices and any pages you don’t recognise.
• Tell your ICB or regional team if you can’t get an answer. NHS England’s alert says that if a site can’t be fixed straight away, the organisation should assess the risk and consider taking it offline until it is.
• If you think the site has been compromised, report it to the NHS England Cyber Security Operations Centre on 0300 303 5222 and tell your data protection officer. If patients’ personal data may have been exposed, a personal data breach may need reporting to the ICO within 72 hours.

If this was hard work, it’s worth raising at your next contract review. Our guide to choosing a GP website supplier covers what to expect on security updates.

Our websites

Practice websites on gpsites.co.uk don’t use PHP, so PHP2Shell doesn’t affect them and practices didn’t need to do anything. When practices asked us on 22 October, we could answer the same afternoon.

We keep the software behind every site up to date ourselves. The same day, a critical security update was released for Next.js, the framework our sites are built with. Because every practice runs on one platform, we applied it once and it covered every site. Practices on our platform didn’t need to do anything for that either.