PHP2Shell: the PHP flaw the NSA and NCSC are warning about (and why Nova sites are safe)

On 21 October 2026 the US National Security Agency and the UK's National Cyber Security Centre both published urgent warnings about two critical flaws in PHP, the programming language behind a huge share of the world's websites, including every WordPress site. If your website runs on PHP, this is one to act on today.

What has happened?

Two security flaws, CVE-2026-109618 and CVE-2026-109619, have been found in PHP itself. Together they have been nicknamed "PHP2Shell". Under certain conditions they could let an attacker run their own commands on a web server, without a password and without any prior access.

The important part is that these are flaws in PHP, not in a particular plugin, theme or setting. In the NSA's words, the problem is in PHP itself rather than in the hosted application or its configuration. So a well-built, well-maintained PHP website can still be exposed if the server underneath it has not been updated.

What are the NSA and the NCSC saying?

The NSA expects attackers to start using these flaws and has told US government departments to patch immediately. Its advice to every organisation is to find every system that relies on PHP, apply the patches, add extra logging, replace any old PHP versions that can no longer be patched, and, if a system cannot be updated straight away, to take it offline until it can.

Here in the UK, the NCSC is encouraging organisations to take immediate action. It says any version of PHP may be affected and lists clear priority steps: find all your PHP installations, update to the latest fixed version, apply the PHP Foundation's temporary mitigations if you cannot update, and consider taking the system offline if you cannot do either quickly.

Who needs to worry?

Anyone whose website runs on PHP. That includes:

• Every WordPress website. WordPress is written in PHP, so WordPress sites sit directly in the firing line until their server is updated.
• Other PHP platforms such as Joomla, Drupal, Magento and many bespoke sites.
• Shared hosting, where you rely on your hosting company to update PHP for you.

Updating your WordPress plugins and themes does not fix this. The fix has to be applied to PHP on the server, and the server then needs restarting so the new version is actually in use.

Why Nova websites are not affected

The websites we build at DPOM run on Nova, our own website platform. Nova is not built on PHP, and it is not WordPress. Because PHP2Shell is a flaw inside PHP, a Nova website simply does not contain the thing these warnings are about.

That is one of the reasons we built Nova in the first place. Platforms like WordPress are huge, popular targets: one flaw in the language or a popular plugin can put millions of sites at risk overnight. Nova keeps things lean, fast and under our control, so our clients are not left waiting for someone else's patch.

If you have a Nova website with us, there is nothing you need to do. Find out more about Nova.

What to do if your website runs on WordPress or another PHP platform

• Ask your host or developer today which version of PHP your site runs on, and whether it has been updated to one of the fixed versions above.
• Check the server has been restarted after the update, so the patched version is the one running.
• If you are on PHP 8.1 or older, ask for a plan to move to a supported version. Those versions will not be fixed.
• Keep an eye on anything else that bundles PHP, such as control panels, booking systems or plug-in tools, and apply their updates as they arrive.

Sources: NSA advisory (21 October 2026), NCSC alert (21 October 2026), PHP security advisories CVE-2026-109618 and CVE-2026-109619.