PHP2Shell Security Flaw Shuts Down UK Government Services

Emergency Shutdowns Following the PHP2Shell Security Flaw Discovery

The sudden emergence of the PHP2Shell security flaw has forced 32 UK government services offline while leaving another four partially unavailable. Whitehall officials confirmed the disruption in the House of Lords on Thursday, explaining that preventive measures were deployed immediately after two critical bugs in PHP came to light. Although departments scrambled to patch the underlying vulnerabilities, critical portals including the Office for Budget Responsibility remain dark right ahead of the upcoming national budget announcements.

Php2shell Security Flaw: Global Web Disruption and International Emergency Response

Britain is hardly alone in pulling the plug. Government portals across Germany, France, Belgium, Finland, and the Netherlands have similarly taken precautions. Meanwhile, Australia’s main cybersecurity agency pulled its primary website offline, and the NSA urged organizations worldwide to disconnect vulnerable setups. The PHP2Shell security flaw comprises two specific bugs tracked as CVE-2026-109618 and CVE-2026-109619. These weaknesses allow unauthenticated malicious actors to execute arbitrary remote code directly on unpatched servers, triggering widespread panic.

• 32 Services Offline: Central government portals completely unavailable.
• 4 Partially Down: Restricted operational capacity across agencies.
• 50,000 Warnings: Alerts issued by the NCSC to businesses.
• Global Reach: Affected agencies across Europe and Australia.

Php2shell Security Flaw: How Artificial Intelligence Helped Uncover the Vulnerability

Behind the scenes, the discovery highlights a fascinating shift in vulnerability research. Security firm Calif uncovered one of the core bugs using OpenAI’s advanced GPT-5.6 Sol model, while Google’s Wiz separately found both flaws using automated tools. Because artificial intelligence models are now capable of rapidly spotting subtle code execution vectors, software auditing has shifted into hyperdrive. OpenAI briefed authorities ahead of disclosure to coordinate emergency patches.

Local Councils Face Severe Operational Disruptions

The fallout extends far beyond central Whitehall ministries. Local authorities including Edinburgh, Oxford, Bristol, Lambeth, and Barnet experienced unexpected outages. That said, critics are questioning why local authorities remain outside the statutory duties proposed under the pending Cyber Security and Resilience Bill.

What This Means for Enterprise and Web Administrators

The bottom line is simple: administrators running custom web applications must audit their server environments immediately. Because the PHP2Shell security flaw grants complete remote execution access, failing to apply official patches leaves infrastructure exposed to automated threat actors.