PHP2Shell: what does it mean for CarePath?
Following NHS England’s PHP2Shell alert and enquiries from clients, we are sharing this explanation to provide context, reassurance and practical guidance, in keeping with our commitment to supporting CarePath services.
What is PHP2Shell?
On 21 October 2026, NHS England published cyber alert CC-4875 concerning two critical vulnerabilities in PHP, a programming language widely used to power websites and web applications.
Researchers have demonstrated that the vulnerabilities can potentially allow an unauthorised attacker to run code remotely or access sensitive information held in server memory. The risk needs attention wherever affected PHP versions are present.
PHP has issued security fixes. NHS England identifies 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as the first fixed versions in their respective release branches. Older releases in those branches are affected; PHP 8.1 and earlier are end-of-life. Organisations using PHP should follow vendor and NHS guidance to verify and update their systems.
Two different environments, two different considerations
A widely reported vulnerability does not automatically affect every technology platform. The first step is to establish where the vulnerable software is actually used.
CarePath application
Microsoft .NET Stack
The core CarePath application is built using Microsoft technologies and SQL Server, not PHP.
ILLY public website
WordPress and PHP
ILLY’s corporate website uses WordPress, a PHP-based platform, and is distinct from the CarePath application.
Our position: We have no identified CarePath-specific concern arising from PHP2Shell. The core application does not use PHP, and the WordPress.com hosting provider has confirmed protection for sites on its platform. This is an assessment of the relevance of this particular alert, not a claim that any system is immune to all cyber threats.
How security alerts should be assessed
Good vulnerability management involves more than checking the name of a product. It requires a structured assessment of the technology and its operational context.
- Understand the threat Review authoritative notices from NHS England, security agencies and relevant technology vendors.
- Check applicability Establish whether the affected software exists in the application, its infrastructure or supporting services.
- Assess and remediate Determine exposure, apply relevant fixes and verify that the required action has been completed.
- Review security monitoring Consider whether any signs of attempted exploitation or compromise require further investigation.
- Communicate the findings Provide clients with clear, accurate, appropriately evidenced conclusions and any necessary actions.
What should CarePath clients do?
No action is required from CarePath users in response to the PHP2Shell alert. CarePath’s core application does not use PHP, and the separate ILLY public website is covered by WordPress.com’s published platform protection.
We know that the recent NHS cyber alert, widespread coverage and supplier assurance requests have understandably prompted questions. We are sharing this FocusOn to provide context, explain why this particular vulnerability does not require changes by CarePath users, and offer reassurance to the organisations we support.
We will continue to review relevant security developments through our established processes and work with our clients, as we always do. Organisations should continue to follow NHS England guidance for any PHP-based systems they manage themselves.
Need further information or a formal supplier assurance response? Existing CarePath clients can use their established support arrangements. For other enquiries, our general Contact Us page remains available.