On 21 October 2026, the UK National Cyber Security Centre (NCSC) urged organisations to act immediately on two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Together, these vulnerabilities are widely referred to as PHP2Shell.
The issue is in PHP itself. Under certain conditions, an unauthenticated attacker could exploit memory corruption to execute code on a PHP web server. The NCSC advised organisations that could not update or apply temporary mitigations to consider taking affected systems offline until they were fully mitigated.
Camp & Event Solutions Ltd took our systems offline as a precaution in response to PHP2Shell. We did this to protect the safety and integrity of youth and adult data. Our systems are now back online.
Further information
Read the NCSC alert and recommended actions and the PHP security advisory.