The UK’s National Cyber Security Centre (NCSC) has issued an urgent warning about a critical security issue affecting PHP, a technology used to run many websites and online services. Published on 21 October 2026, the warning highlights two security vulnerabilities that could allow attackers to take control of a vulnerable web server without needing to log in. If you own a business website, manage an organisation’s online services, or rely on a website to generate enquiries and sales, this is an issue worth taking seriously. The good news is that security updates have been released to fix the problem. However, website owners need to make sure their website, hosting service, and any related software have been properly updated. Here, we explain what the issue means in plain English, who could be affected, and what you should do next.
What Is PHP and Why Does It Matter?
PHP is a programming technology that runs behind the scenes of many websites. It helps websites display information, process forms, communicate with databases, and carry out other tasks needed to make a website work. You may never have heard of PHP, and that is perfectly normal. You do not need to understand how it works to use a website. However, if your website relies on PHP, the security of that technology matters. PHP is used by a wide range of websites, applications, and other software. Some products may include PHP in the background even when the website owner is not aware of it. This means a website or online service could potentially be affected without its owner realising that PHP is involved.
What Is the PHP Security Issue?
The NCSC has highlighted two related security vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. In simple terms, these are flaws in how PHP handles certain information in the computer memory used to run a website. Under particular circumstances, an attacker could take advantage of these flaws to make the server behave in an unexpected way. This could potentially allow them to run their own commands on the server. This is particularly serious because an attacker may be able to do this without a legitimate username or password. If a vulnerable server is successfully compromised, an attacker could potentially interfere with the website, access information available to the server, or use their access to carry out further malicious activity. The exact consequences would depend on the affected system and the access available to the attacker. The important point is that this is not simply a minor website error or a problem that can be ignored until the next routine maintenance appointment. It is a serious security issue, and affected systems need to be addressed promptly. The PHP developers have released security updates to fix the vulnerabilities, and the NCSC is urging organisations to take action.
Who Could Be Affected by the PHP Security Vulnerability?
According to the NCSC, organisations using any version of PHP should take action to check their systems and apply the appropriate security updates. This includes organisations with websites hosted on their own servers, as well as those using external hosting companies or third-party services.
You could be affected if you have:
- A business website that uses PHP.
- A website built using a content management system such as WordPress, Drupal, or Joomla.
- An online shop or customer portal.
- Business software or an online service that uses PHP behind the scenes.
- A third-party product or service that includes PHP as part of its operation.
You do not necessarily need to manage your own server to be affected. If your website is hosted by another company, the hosting provider or website maintenance company may need to carry out the necessary checks and updates. It is also important to understand that having a website built with WordPress or another popular platform does not automatically mean it has been compromised. The issue concerns the PHP software running behind the website, and the key priority is to establish whether the affected software is present and properly updated.
What Should You Do to Protect Your Website?
The NCSC recommends that organisations take immediate action to identify affected systems and apply the necessary security updates.
If you are responsible for a website, there are several practical steps you should take.
1. Contact Your Website Hosting Provider
If you do not manage your own website server, contact your hosting provider or the company responsible for maintaining your website. Ask them to confirm whether your website or hosting environment uses PHP and whether the security updates addressing CVE-2026-109618 and CVE-2026-109619 have been applied. Do not assume that everything is protected simply because your hosting company carries out routine maintenance. Ask for confirmation that this specific security issue has been addressed.
2. Make Sure PHP Has Been Updated
The recommended solution is to update PHP to a version that contains the security fixes. This should be handled by someone who understands your hosting environment and the software your website relies on. Updating the wrong component without checking compatibility can cause problems, so it is important that the work is carried out appropriately. If you are using an older version of PHP that is no longer supported, you may need to move to a supported version rather than simply applying a routine update. Your hosting provider or website developer should be able to advise you on the appropriate approach.
3. Check Any Third-Party Software
PHP is not always installed as a separate component that a website owner can easily identify. It can also be included within other software products and services. If your business relies on specialist online systems, customer portals, or other hosted services, ask the relevant supplier whether they have checked for this vulnerability and applied the necessary fixes. This is particularly important for businesses that rely on several different online systems to operate.
4. Consider What to Do if an Update Cannot Be Applied Immediately
The NCSC advises organisations to use temporary protective measures if they cannot apply the security update straight away. If appropriate temporary measures cannot be put in place quickly enough, taking the affected system offline may need to be considered until it can be secured. This decision should be made with your hosting provider or a suitably qualified security professional, taking account of the risks and the impact on your business. If a system cannot be updated or disabled immediately, the NCSC also recommends checking for signs that an attacker may already have gained access. This may require specialist security assistance.
5. Keep Your Website Software Up to Date
This issue is also a useful reminder of the importance of ongoing website maintenance. Security updates are released to address newly discovered weaknesses. Keeping your website platform, extensions, server software, and other components updated helps reduce the risk of known vulnerabilities being exploited. However, updating your website’s content or WordPress plugins is not necessarily the same as updating PHP itself. These are separate components, and each needs to be checked as appropriate. A reliable maintenance arrangement should make clear who is responsible for each part of the website and how security updates are handled.
Could This Affect Your WordPress Website?
WordPress is widely used for business websites, blogs, and online shops, so it is understandable that WordPress website owners may be concerned about this warning. WordPress uses PHP to run many of its core functions. As a result, the security of the PHP environment supporting a WordPress website is important. However, the issue should not be confused with a specific WordPress plugin vulnerability. The NCSC warning concerns PHP itself, meaning that updating WordPress alone may not resolve the problem. If your website is hosted by a third party, the hosting provider will generally be responsible for maintaining the server-side PHP environment, although the exact division of responsibility depends on your hosting arrangement. If you manage your own server, you or your technical team will need to identify the PHP installations, check the relevant security updates, and ensure that affected systems are protected. If you are unsure who manages this part of your website, now is a good time to find out.
Why Website Security Should Not Be Overlooked
For many businesses, a website is an essential part of everyday operations. It may generate customer enquiries, process orders, provide information, or support existing customers. A serious security problem can therefore have consequences beyond the website itself. Depending on the circumstances, a successful attack could lead to disruption, unauthorised access to information, damage to the website, or additional work to restore affected systems. This is why security updates should be treated as an important part of running a business, rather than something to consider only when a problem occurs. At the same time, it is important not to panic. The existence of a vulnerability does not mean that every affected website has been hacked. The sensible response is to establish whether your systems are affected, confirm that the appropriate fixes have been applied, and investigate any concerns about possible unauthorised access.
Our Advice: Check Your Website and Act Promptly
At the time of writing, the NCSC is encouraging organisations to take immediate action in response to these PHP security vulnerabilities. Our advice is straightforward: if your business relies on a website, do not assume that someone else has already dealt with the issue. Contact your website developer, hosting provider, or IT support company and ask them to confirm that the necessary checks and updates have been completed. If you manage several websites or online services, make sure that each relevant system has been considered, including any third-party products that may use PHP behind the scenes. If a system is found to be vulnerable, arrange for it to be updated or protected as a priority. If there is reason to suspect that a system has already been compromised, seek appropriate security assistance rather than assuming that installing an update will resolve every problem. You can read the official guidance directly from the National Cyber Security Centre: Critical security issue affecting PHP.
Final Thoughts
Security issues like this demonstrate why keeping the technology behind your website maintained and updated is so important. You do not need to be a technical expert to take the right first step. You simply need to know who is responsible for your website and ask the right questions. If you are unsure whether your website is affected, speak to your hosting provider or website maintenance company and request confirmation that the PHP security issue has been addressed. Taking action promptly can help protect your website, your business, and the people who rely on your online services.