Construction businesses running websites, tender portals or supplier systems on PHP are being urged to patch two critical vulnerabilities or consider taking affected systems offline, after the National Cyber Security Centre warned that the flaws could allow attackers to execute commands on any web server running the language. The PHP project released emergency fixes on 21 October for the vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which have been dubbed PHP2Shell and can be exploited with a single unauthenticated web request.
The scale of the response has been unusual. Technology minister Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four partially unavailable, which she said had "largely resulted from precautionary measures", and NCSC chief technology officer Ollie Whitehouse said the centre had "issued over 50,000 warnings to organisations in the United Kingdom", ITV News reported. Amazon Threat Intelligence recorded an exploitation attempt against one of its honeypots on 17 October, four days before public disclosure, according to Help Net Security. No UK construction business had publicly reported a compromise linked to the flaws by the evening of 22 October.
A construction project office facing an urgent website security update, illustrating the cyber risk posed by critical PHP vulnerabilities to contractor and supplier systems. Illustration: London Construction Magazine.
Where Construction Is Exposed
PHP sits underneath WordPress, Drupal, Magento and many bespoke web applications, which means the exposure in construction extends well beyond company brochure sites. Subcontractor onboarding and prequalification portals, tender document download sites, builders' merchant and product-manufacturer online shops, recruitment pages and project microsites built by agencies can all run on PHP, often on hosting arranged years ago and managed by a third party rather than the firm itself.
Because the flaws sit in PHP itself, updating WordPress, its plugins or a website theme does not fix them. WordPress.org said in its critical PHP security release notice that "no WordPress update is required or planned for these issues" and that site owners should update PHP on their servers, which they can check under Tools > Site Health > Info > Server. On shared and managed hosting, the host usually controls the PHP version; on a self-managed server or a virtual private server set up by an agency, nobody may be patching it unless the business asks.
Fixed PHP Versions
| PHP branch | Fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 and older | No longer supported by the PHP project; source backports published for 7.4, 8.0 and 8.1, with some Linux distributions and long-term support vendors providing their own fixes |
Sites still running PHP 8.1 or older are the most exposed, because those versions only receive fixes through a Linux distribution, hosting provider or long-term support vendor, and upgrading an old site to a supported branch can break older themes and plugins. The PHP project has also published temporary configuration mitigations for administrators who cannot update immediately, while warning that they reduce exposure but do not fully protect against exploitation.
What the NCSC Is Asking Organisations to Do
The NCSC guidance says "organisations using any version of PHP are affected" and asks them to identify systems running PHP across their infrastructure, prioritising those facing the internet, and to update to the latest version. Where an update or temporary mitigation cannot be applied quickly, it says organisations "should consider taking the system offline until it can be fully mitigated", and it asks them to check for evidence of compromise, including backdoors, before upgrading.
For a contractor or supplier, the first practical step is a list of every web-facing system, including those run by agencies, hosting companies and software providers, followed by written confirmation from each of the PHP version in use and when it was patched. The NCSC also asks organisations to monitor security updates from third-party vendors, including "appliances and services that may bundle PHP", and recommends its free Early Warning service for notifications of potential threats on a company's network.
Taking a system offline has consequences that a construction business should plan for rather than discover. A subcontractor portal that goes down during prequalification, or a tender document site that becomes unavailable before a return date, needs an alternative route for bidders and a clear notice of any extension. LCM looked at the same dependency on third-party technology when it examined how the Google Cloud outage exposed construction's reliance on cloud and AI services.
Cyber Essentials and the Supply Chain
The flaws also have a compliance dimension for firms that hold Cyber Essentials, which is required on some public-sector contracts and commonly requested by main contractors in prequalification. Under the scheme's security update management control, updates that fix vulnerabilities the vendor describes as "critical" or "high risk" must be applied within 14 days where the scheme's conditions apply, according to certification body IASME. Firms whose in-scope systems run PHP should therefore expect the patch to be checked at their next assessment.
Main contractors with supply-chain portals or shared project platforms are also exposed through the businesses connected to them. Asking key suppliers and software providers to confirm their PHP patch status is a proportionate step this week, particularly where those suppliers host systems that hold project documents, payment details or personal data. The NCSC said it will continue to monitor for any impact on UK organisations.
Expert Verification & Authorship
Founder & Author, London Construction Magazine | Construction Testing & Investigation Specialist