PHP2Shell: Understanding this serious cyber security issue as a care provider

You may have seen reports about a new cyber security issue called PHP2Shell. Reports that may well strike fear, or at least uncertainty into the hearts of our increasingly digitised sector.

Terms such as “critical vulnerability”, “PHP”, “CVE” and “remote code execution” can make stories like this sound extremely complicated. Unless you work in IT or cyber security, there is no reason why you would be expected to know what they mean.

So let’s strip away the technical language and explore what this means for providers utilising digital technology.

PHP2Shell is essentially a widespread serious security fault. One that was discovered in a very common piece of technology. A large number of websites and online services use this technology.

A fix is available.

The important thing for care providers is making sure that the people and companies responsible for their technology have applied it.

When you visit a website or use an online system, there is a lot happening in the background that you never see. You see buttons, forms, pages and information. But you don’t see the mechanisms operating them.

Behind those pages is software doing things such as processing requests, retrieving information and deciding what should appear on your screen.

You don’t install it on your laptop and you aren’t expected to interact with it. It normally operates behind the scenes on the computers that provide websites and online applications.

It is widely used and can be found behind platforms such as Facebook, Wikipedia and Etsy, as well as other websites, business applications and technology products.

This means your organisation could rely on something that uses PHP without you knowing about it. That is completely normal, and quite common.

A vulnerability is simply a weakness or fault in technology that could affect its security.

Imagine a manufacturer discovers that one particular model of door lock has a fault. Your door hasn’t necessarily been opened. Nobody has necessarily entered your building. But if someone discovers how to take advantage of that fault, the lock might no longer provide the protection it was designed to provide.

Software vulnerabilities work in much the same way.

Once a serious vulnerability is discovered, the company or people responsible for the software will normally produce a security update, often called a ‘patch’, to correct it. PHP2Shell is the name being used for two particularly serious vulnerabilities discovered in PHP.

You might have seen references to:

‘CVE-2026-109618’ and ‘CVE-2026-109619’.

Don’t panic! This isn’t a deeply complicated technology term. A CVE is essentially a reference number for a publicly known cyber security vulnerability.

You don’t need to remember these numbers or understand how the numbering works. They simply allow IT teams, software companies and security researchers to make sure they’re all talking about the same security problem. For this particular issue, the two reference numbers are CVE-2026-109618 and CVE-2026-109619.

In short, because the weaknesses are considered serious.

If someone successfully takes advantage of them, they could potentially make an affected computer run commands that it shouldn’t. More importantly, an attacker doesn’t necessarily need to know someone’s password first. You might hear IT teams describe this as”remote code execution”.

Again, don’t worry about the terminology.

In very simple terms, it means:

Someone on the internet may be able to make a vulnerable computer do something that its owner didn’t intend it to do.

The potential consequences depend upon the affected system, but that is why organisations have been treating PHP2Shell seriously.

Information about two serious problems in PHP began circulating publicly on 20 October 2026, ahead of the planned security update. The organisations responsible for PHP subsequently released fixes on 21 October 2026. There have also been reports of attackers attempting to exploit these weaknesses.

That creates urgency because, once criminals know that a weakness exists, organisations need to fix their systems quickly. Going back to our lock example:

The manufacturer has announced that the lock has a fault, instructions for exploiting the fault are becoming known, and replacement parts are available.

The priority therefore becomes identifying those locks and fixing them.

NO.

Having technology that contains a vulnerability does not mean that somebody has successfully attacked it. Think about a recall on your car.

Learning that your particular model has a faulty component doesn’t mean that you have had an accident. It means the manufacturer has identified something that needs fixing to prevent a problem occurring.

It is much the same here. However, because PHP2Shell is considered a serious vulnerability and attack activity has been reported, organisations shouldn’t ignore it.

If you’re a registered manager, care home manager or operational leader, you aren’t expected to fix PHP2Shell yourself. You need to find out whether the people responsible for your technology have dealt with it.

This can include:

The NHS England cyber alert advises organisations with affected technology to install the appropriate security update.

You naturally want to know if you are affected or not. But you don’t need to use technical terminology to find out. Simply send your IT provider this:

“We’ve become aware of the PHP2Shell security issue. Can you confirm whether any of our systems or websites are affected, whether they have now been updated and whether you have checked for any signs that the vulnerability was exploited before the update was applied?”

This is a straightforward, reasonable request to make. In addition, you can ask your IT provider to respond to you in plain english, to avoid drowning in technical jargon.

This is particularly important for care providers. More and more providers utilise multiple digital systems to support their service. You probably don’t know what programming technologies those systems use.

You aren’t expected to.

Your supplier is responsible for managing the technology underpinning the service it provides. For systems that are particularly important to your organisation or the delivery of care, however, there’s nothing wrong with asking the supplier for reassurance.

“Can you confirm whether the PHP2Shell security issue affects the service you provide to us and, if it does, whether it has now been resolved? Please also confirm whether you have found any indication that our service or data was affected.”

A good supplier should be able to give you a clear answer, in plain English.

No. The old adage applies, be alert, not alarmed.

Serious software vulnerabilities are an unfortunate reality of our increasingly digital world.

PHP2Shell deserves attention because of the potential seriousness of the security weakness and the widespread use of PHP. But the appropriate response isn’t to disconnect every computer or stop using digital systems.

The best response is:

Following disclosure of PHP2Shell, Nourish Care’s Security and Engineering teams assessed our production platforms and completed the necessary security updates.

We can confirm that all Nourish Care production platforms have been updated and are no longer exposed to the PHP2Shell vulnerabilities.

At the time of publishing, Nourish Care has also identified no evidence of attempted or successful exploitation within our production environments. Our Security and Engineering teams continue to vigilantly monitor developments and relevant security intelligence.

If you forget everything else in this article, remember these three key points.

1. PHP2Shell is a security weakness in technology used behind many websites and online services.

You don’t need to understand the technology to respond to the risk.

2. Ask your IT provider whether you are affected and whether everything has been updated.

If you use externally provided systems that are particularly important to delivering care, consider asking those suppliers too.

3. Don’t panic!

A vulnerability being discovered does not mean you’ve been hacked.

What matters is whether your organisation and its suppliers can identify the problem, fix affected systems and check for signs that somebody took advantage of it. Good cyber security comes down to knowing your role and responsibilities.

It’s about making sure you know the right questions to ask the right people, so your community stays safe.

Back to articles