PHP2Shell takes 32 UK government services offline

Two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have left 32 UK government services unavailable and four partly disrupted. Ministers say there is no confirmed compromise of central government systems; Germany, France, Belgium, Finland, the Netherlands and Australia also took sites offline as a precaution.

• 32 UK government services offline, four partially unavailable
• CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution
• NCSC sent 50,000 warnings to organizations
• AWS says attacks began four days before public disclosure