Hexham based Instilled explain the recent critical PHP security website flaws

On Wednesday 21 October, the team behind PHP released urgent security updates for two critical flaws. PHP is the programming language that powers a huge share of the web, including every WordPress site. The UK’s National Cyber Security Centre (NCSC) has urged organisations to act immediately.

If your website is hosted with Hexham-based Instilled, you’re already protected: we upgraded every one of our servers to the latest secure version of PHP as soon as the fixes were released.

What happened

Two separate bugs were found deep inside PHP itself, not in any particular plugin or theme. Security researchers have nicknamed them “PHP2Shell”.

  • CVE-2026-109618 – if PHP runs out of memory at exactly the wrong moment, it can leave behind half-finished data that it later treats as valid. A carefully crafted request can turn this into a way to run code on the server.
  • CVE-2026-109619 – after certain errors, PHP can keep hold of information from a previous visitor’s request. The next request handled by the same process can then misuse it, again opening the door to running code.

The PHP Foundation rates both as critical (CVSS 9.2). Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older, unsupported versions (8.1 and earlier) are not officially patched, although our servers have also backported fixes to these versions.

Full story what to do

This link will take you to the full article on the Instilled website