Two critical security vulnerabilities discovered in PHP have prompted urgent warnings from cybersecurity authorities. With PHP used by millions of websites and web applications, businesses need to understand the risks, check who is responsible for their website security and make sure the necessary updates are applied.
What Has Happened With PHP?
On 21 October 2026, the PHP development team released security updates to address two critical vulnerabilities affecting PHP, a programming language widely used to run websites and web applications.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code on vulnerable web servers without needing to authenticate first. Both received a critical severity score of 9.2 out of 10.
The UK National Cyber Security Centre (NCSC) issued guidance urging organisations to identify affected systems and apply the necessary security updates immediately. NHS England also reported that researchers had demonstrated proof-of-concept exploits against products incorporating PHP, including WordPress, Drupal and Joomla.
Although this does not mean every website using PHP has been compromised, it highlights the importance of keeping the software behind business websites properly maintained.
Why Are These PHP Vulnerabilities So Serious?
PHP runs behind the scenes, processing requests and generating content before a website appears in a visitor’s browser. Because it operates on the server, a vulnerability in PHP can create risks that extend beyond the website’s visible pages.
The two vulnerabilities affect how PHP handles certain errors and internal memory. Under specific conditions, this can allow an attacker to exploit the server and execute code remotely.
In practical terms, successful exploitation could give an attacker an opportunity to interfere with a vulnerable system. Depending on the server’s permissions and configuration, this could potentially lead to data exposure, website disruption or further compromise.
One particularly concerning aspect is that an attacker may not need a legitimate account to exploit a vulnerable installation. This means that simply requiring users to log in does not address the underlying problem.
Security researchers have demonstrated proof-of-concept exploitation, making it particularly important for organisations responsible for PHP-based systems to check their exposure and confirm that appropriate action has been taken.
Could This Affect Your Business Website?
PHP is commonly used by content management systems and web applications. WordPress, which powers a large proportion of business websites, is one familiar example.
However, this is a vulnerability in the PHP runtime, not a vulnerability specific to WordPress itself. The risk depends on the PHP software running on the underlying server and whether the relevant security fixes have been applied.
If your business operates a website built with WordPress, Drupal or another PHP-based platform, establish who manages the hosting environment.
Depending on how the website is hosted, responsibility may sit with your hosting provider, website developer or internal technical team. Some managed hosting services handle PHP updates themselves, while other arrangements require the website owner or administrator to arrange them.
Updating WordPress themes and plugins is good practice, but it does not necessarily resolve a vulnerability in the PHP software running on the server.
If you are unsure who manages this part of your website, ask them to confirm which PHP environment is in use and whether the relevant security updates have been applied.
How Can Businesses Protect Themselves?
The PHP development team has released fixes for the two critical vulnerabilities. The NCSC recommends identifying affected systems, prioritising those exposed to the internet and applying the appropriate updates.
Businesses should take the following steps.
- Identify Systems Running PHP
Establish whether your business operates any websites, web applications or other services that use PHP. Include externally hosted services and systems managed by third parties.
Do not assume that a website is unaffected simply because your internal IT systems run different software. Website hosting and business IT are often separate environments with different management responsibilities.
- Confirm That Security Updates Have Been Applied
Contact the hosting provider, website developer or server administrator responsible for the affected environment.
For standard PHP releases, the fixes were included in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. However, software vendors and some Linux distributions may supply security fixes differently, including through backported updates. The correct version to use therefore depends on the environment and its supplier.
Do not rely solely on a version number without checking the relevant vendor’s guidance. Ask for confirmation that the affected vulnerabilities have been addressed.
- Review Older and Unsupported Software
Older PHP releases may no longer receive security updates directly from the PHP project. Some operating system vendors provide their own security fixes, but this needs to be confirmed rather than assumed.
If a website relies on an unsupported version, a longer-term upgrade may be necessary. This should be planned carefully to account for compatibility with the website, plugins, integrations and hosting environment.
- Keep Monitoring for Further Security Advice
Applying an update is essential, but it should not be the only security measure an organisation takes.
The PHP project has issued follow-up guidance since the initial release, demonstrating why administrators should continue to monitor relevant security announcements and check that their installed packages remain current.
For websites and applications exposed to the internet, organisations should also review access permissions, logging, backups and their ability to investigate suspicious activity.
- Make Security Maintenance Someone’s Responsibility
One of the most important lessons from this incident is the need for clear ownership.
If a business assumes its website developer handles security, while the developer assumes the hosting provider is responsible, an important update could be missed.
Businesses should know who is responsible for maintaining each part of their technology, how security updates are monitored and what happens when a critical vulnerability is announced.
This applies to websites, but also to business computers, servers, cloud services, network equipment and other systems that need regular maintenance.
Why Proactive IT Management Matters
Critical vulnerabilities like these demonstrate how quickly a new security issue can become a priority for organisations.
The challenge is not simply knowing that a vulnerability exists. Businesses also need to establish whether they are affected, identify the right person to take action, apply the appropriate fix and verify that the issue has been addressed.
For organisations without a dedicated IT team, managing these responsibilities can be difficult alongside everyday business operations. Even businesses with internal IT staff can benefit from a structured approach to maintenance, security monitoring and supplier management.
Proactive IT management helps reduce the chance of important updates being overlooked. It also provides a clearer picture of the systems a business relies on and who is responsible for keeping them secure.
Managed IT Support That Keeps Your Business Protected
At Ventrix IT, we believe businesses should not have to wait for a technical problem before their IT receives attention.
Our managed IT services help businesses across Kent and the South East maintain reliable, secure and well-managed technology. We combine day-to-day IT support with proactive maintenance and cyber security, helping customers address issues before they become larger problems.
Working with an IT partner should also mean having someone who understands your environment, offers practical advice and helps make sure responsibilities are clear. Where a website or application is managed by a separate hosting provider or developer, it is important to know who is responsible for maintaining that service.
With Ventrix, businesses have a personal, approachable team to help manage their IT, strengthen their security and provide ongoing support as their needs change.
Big Enough to Support. Small Enough to Care.
If you want greater confidence that your business IT is being properly maintained and managed, find out more about Ventrix IT’s managed IT services.
Sources
