decrypted · 22 october 2026 · vulnerabilities and patching · supply chain · ai and llm security

PHP's flaws have now taken government services offline, and exploitation began before the patch

Yesterday's PHP story has gone from advisory to outage. Ministers told the Lords on Thursday that 32 government services were unavailable and four partially unavailable, largely through precautionary measures while updates and mitigations were applied. Downing Street said that does not mean the systems were hacked, and that no large public-facing critical services were affected.

What is new since the advisory

The NCSC, the National Cyber Security Centre, published its alert on 21 October for CVE-2026-109618 and CVE-2026-109619. It says organisations using any version of PHP are affected. Its advice is plain: update to the latest version, and if mitigations cannot be applied quickly, consider taking the system offline until they can. Government appears to have done exactly that.

The fresh evidence concerns exploitation. Help Net Security reports that Amazon's honeypot recorded an exploitation attempt on 17 October, four days before public disclosure, and that how the attacker obtained the details is still unknown. LBC reports that Cloudflare's Matthew Prince saw thousands of attempts in the ten hours before the announcement.

How the flaws work

Picture a restaurant kitchen where a torn-up order leaves a pan on the hob, and the next order is cooked on top of it. BleepingComputer explains that PHP can leave its memory in a corrupted state when a request ends abnormally, and both flaws grow from that. One abuses out-of-memory handling. The other leaves stale internal state behind after the memory has been freed. Either can give an attacker remote code execution, or RCE, meaning they run their own commands with the web server's privileges.

The PHP team says the risk is highest with mod_php, where one unauthenticated request can trigger the attack before any application code runs. That is why updating your content management system changes nothing: the fault sits underneath, in the language runtime.

What the defender sees

Very little. The request looks like ordinary web traffic, and the damage happens before your application logs anything. Cloudflare says sites behind it have an initial set of WAF rules, a web application firewall being a filter in front of a website, but PHP's own advice is that interim settings such as memory_limit=-1 do not fully protect you. Updating is the only safe choice. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal backports for 7.4, 8.0 and 8.1.

The Secure by Design lesson

The lesson is dependency you cannot see. Many UK organisations cannot say how many PHP installations they run, because PHP hides inside appliances, intranets and supplier portals. Secure by Design means holding that inventory before the alert arrives, and having a rehearsed way to take a service down cleanly, which is what the government's Thursday amounted to. It costs a spreadsheet and an afternoon.

Amazon's attempt four days before disclosure carries a second lesson. The quiet period before a patch is not safe, so assume exploitation can begin before your supplier's email arrives.

Also this week

LiteLLM's release pipeline was hijacked. LiteLLM, a Python library many teams use to talk to different AI model providers, says a malicious version 1.107.0 was live on PyPI, Python's public library of add-on packages, from 12:39 to 14:23 UK time on 21 October. Container images were affected until 15:20. Socket's scanner flagged it about seven minutes after publication. LiteLLM says the attacker used developer GitHub tokens, disabled branch protection and pointed the build at a lookalike repository, Berri-AI instead of BerriAI. The payload is a credential stealer that runs whenever Python starts, even without importing the library. LiteLLM says the initial access is unconfirmed and that earlier versions are safe: pin 1.106.2, rebuild rather than clean, and rotate provider keys and database passwords on any host that installed 1.107.0. The design lesson is that release rights should not hang on a handful of personal tokens. Opinion: if your AI tooling sits in the build path, it deserves the same scrutiny as any other supplier.

AI found the PHP flaws, and that changes the clock. Downing Street said the NCSC is working with OpenAI, whose technology was used to discover the vulnerabilities, and the tech minister said the NCSC was briefed last week and government acted before public disclosure. BleepingComputer credits researchers at Calif, OpenAI and Wiz. LBC, citing the Wall Street Journal, says a model found the flaw in August; treat that detail as reported, not confirmed. The practical point for directors: ask your suppliers how they receive pre-disclosure warnings, because the gap between discovery and exploitation is shrinking. Opinion: that is a procurement question, and it belongs in the contract.

Sources

If you want help mapping where PHP and other hidden dependencies sit in your estate, get in touch.