New patch-rate data shows UK organisations trailing the EU on fixing the PHP2Shell vulnerabilities, with confirmed real-world exploitation now underway. For vulnerability management services teams and hosting providers, the gap between disclosure and patching is becoming the industry's defining compliance risk.
View the data behind this chart
| Netherlands | DACH region | BE/BG/CZ/FI avg | UK | US | |
|---|---|---|---|---|---|
| Patch rate | %50 | %40 | %30 | %25 | %20 |
UK patch rates trail the EU by a wide margin
Live tracking data cited by Computer Weekly shows a clear north-south, east-west split in how quickly organisations are closing off the PHP2Shell vulnerabilities. The Netherlands leads with patch rates approaching 50% of exposed hosts, with the DACH countries — Austria, Germany and Switzerland — close behind at nearly 40%. Belgium, Bulgaria, Czechia and Finland sit around the 30% mark.
UK organisations, by contrast, have patched barely a quarter of exposed hosts. The US is doing worse still, at just under 20%. Globally, UK-based cyber startup Infrawatch recorded 412,000 patched PHP hosts out of the visible total as of 12pm on Monday 26 October — roughly 19% worldwide. For UK buyers benchmarking their own exposure, the message is blunt: being level with the global average is not good enough when peer economies are moving two to three times faster.
Exploitation has moved from theory to confirmed reality
According to Bleeping Computer, a Perplexity researcher has confirmed observing remote code execution against PHP2Shell after deploying honeypots running a vulnerable PHP version. That confirmation — even in a controlled, non-impactful environment — strongly implies that genuine production systems have already been compromised in the wild.
Keith Simpson, group operations head at Aberdeen-based managed services provider Converged Solutions Group, said the exploitation news "isn't surprising, but it adds even greater urgency towards patching," warning that AI is compressing the window between disclosure and active exploitation to the point where it is often shorter than the time organisations need to apply fixes. He added that while some affected websites have simply been taken offline as a stopgap, this is not sustainable, and organisations that haven't patched must act immediately.
Nation-state interest raises the stakes for hosts
Threat intelligence firm Cyfirma says it has identified a North Korean-nexus actor linked to the Lazarus Group that is "actively staging a global offensive campaign" against internet-facing PHP runtimes. That changes the risk calculus for any UK hosting or infrastructure provider running unpatched PHP estates — this is no longer opportunistic, low-skill scanning alone, but a target set attracting well-resourced state-affiliated operators.
Analysis firm Moodys notes that exploitation already appears to be originating from multiple distinct threat actors, and that SMEs with weaker cyber postures face the greatest difficulty identifying and remediating vulnerable instances. Moodys warns this could produce a "long tail" of individual compromises surfacing for months after the initial disclosure, rather than a single contained incident.
Compliance and client liability exposure for UK providers
For UK hosting companies and MSPs, a sub-25% patch rate against confirmed in-the-wild exploitation is a direct liability problem, not just a technical one. Clients relying on shared or managed infrastructure will reasonably expect providers to have already remediated a vulnerability this widely reported, and failure to do so raises serious IT compliance risks around contractual SLAs, data protection obligations and incident disclosure duties.
This comes as the UK continues to strengthen its cybersecurity legislation, which will sharpen expectations on how quickly regulated and critical-sector organisations must respond to known, actively exploited vulnerabilities. Providers still lagging on PHP2Shell risk being caught out twice — once by attackers, and again by regulators and clients asking why remediation took so long.
What UK hosting and infrastructure buyers should do now
Patching alone is no longer sufficient once exploitation is confirmed. Security teams should be running active threat detection to establish whether a breach is already in progress, not just closing the vulnerability going forward. Buyers reviewing their estate should prioritise visibility across every public-facing PHP instance, including legacy or forgotten systems often maintained under older third-party maintenance for infrastructure arrangements.
Longer term, this incident reinforces the case for structured effective patch management strategies, layered with managed detection & response and segmentation principles drawn from zero trust architecture, so that a single unpatched application server cannot become a route to full network compromise or ransomware deployment.
- •Audit every public-facing PHP host, including shadow IT and legacy systems under third-party contracts
- •Patch immediately and verify remediation rather than assuming a deployed fix has taken effect
- •Activate detection and response to check for prior compromise, not just future prevention
- •Review client-facing SLAs and compliance obligations tied to vulnerability response timelines
- 01Computer Weekly — EU makes progress towards PHP patching, UK lags behind · 26 October 2026