Updated 22 October 2026
If your website runs on WordPress, WooCommerce, Magento, Drupal or a custom build, it almost certainly runs on PHP. On 21 October 2026 the UK’s National Cyber Security Centre (NCSC) issued an alert about two serious flaws in it. This guide explains what happened in plain English, what it means for a business website, and what to ask your web team today.
What has the NCSC said?
The NCSC says a PHP security update addresses a critical issue that “may allow attackers to execute commands on any web server running PHP”. Under certain conditions, it says, the flaw could be exploited for unauthenticated remote code execution. In other words, an attacker would not need a login.
Two vulnerabilities are involved:
- CVE-2026-109618: a problem in how PHP behaves when it runs out of memory part-way through setting up a request.
- CVE-2026-109619: request data that is still used after the memory holding it has been freed, so a later request can pick up stale state.
The NCSC states that all versions of PHP are affected. Its advice is not limited to old installations.
Why does this matter for a business website?
PHP runs the server side of most of the web. Your hosting company runs it, and your website’s software depends on it. A flaw at that level is different from a weak password or an out-of-date plugin, because it sits underneath everything else. Plugin updates and a strong admin login do not fix it. Only a patched PHP does.
Remote code execution is the most serious category of web vulnerability. If an attacker can run commands on the server, the realistic consequences include a defaced or redirected site, stolen customer or enquiry data, malware served to your visitors, and your domain being blacklisted by search engines and email providers.
Is it being exploited?
The NCSC page does not say it is. It says it will keep monitoring for impact on UK organisations. Independent reporting is less comfortable: Help Net Security reports that a working exploit exists and that Amazon’s honeypot recorded an attempt on 17 October, four days before public disclosure. Treat this as a “patch this week” matter, not a “patch at the next maintenance window” matter.
Which PHP versions have the fix?
According to Help Net Security, the fixed releases are:
| PHP branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
For PHP 8.1, 8.0 and 7.4, which are no longer supported by the PHP project, the same report describes the fixes as minimal source backports rather than full releases. If your site is on one of those versions, the sensible answer is to move to a supported release, not to rely on a backport. Some hosts and operating system vendors also patch their own PHP builds, so a version number alone does not always tell you whether a server is fixed. Ask your host.
Want a free audit like this for your own site?
We'll show you exactly what's holding your rankings and conversions back. No sales pitch.
Get My Free AuditWhat the NCSC recommends, in order
- Find every PHP installation you rely on, starting with anything internet-facing. Do not limit the search to old versions.
- Update to the latest PHP version and keep watching for further updates.
- If you cannot update, apply the PHP Foundation’s temporary mitigations.
- If you cannot do that quickly, consider taking the system offline until it is protected.
- If a system could not be updated or disabled straight away, check it for signs of compromise and backdoors. If you lack the confidence to do that in-house, use an NCSC-assured Cyber Incident Response provider.
- Keep monitoring your suppliers. Appliances and hosted services can bundle PHP, so their updates matter too.
Five questions to ask your web team today
- Which PHP version is our website running right now, and on which server?
- Has it been updated to a release containing the fix, or has our host confirmed a backport?
- Do we run anything else on PHP: a staging site, a booking system, a customer portal, an old microsite?
- If the update is not done yet, what temporary protection is in place, and until when?
- When did someone last check the site for unexpected files, new admin users or odd redirects?
A good web partner can answer all five in a single email. If the answers are vague, or nobody can say who is responsible for the server, that is the real finding. It is also a good moment to look at who looks after your website hosting and maintenance.
What about your Google rankings?
Security is not a separate topic from search. A compromised site can be flagged with browser warnings, have spam pages injected, or be dropped from results while it is cleaned up, and recovery can take weeks. Keeping PHP, WordPress and plugins current is basic technical SEO as well as basic security.
What should you do this week?
- Send the five questions above to whoever hosts and maintains your site.
- Ask for the PHP version in writing, plus the date it was updated.
- Make sure you have a recent, restorable backup stored away from the server.
- Review who has admin access, and remove anyone who no longer needs it.
- Keep your WordPress core, theme and plugins up to date so that a server-level patch is not the only thing standing between you and trouble. If you run WordPress, our WordPress development team can help with maintenance.
Need a reliable web partner?
If you are not sure who is responsible for patching your website, or you would like a second pair of eyes on it, talk to Amax Marketing. We can tell you what your site is running and what needs doing.
Frequently asked questions
What is the PHP vulnerability the NCSC has warned about?
Two flaws, CVE-2026-109618 and CVE-2026-109619, in how PHP handles memory while processing web requests. The NCSC says they could allow attackers to run commands on a web server, in some circumstances without logging in.
Is my website affected?
If your site runs on PHP, which includes WordPress, WooCommerce, Drupal and Magento, assume yes until your host or developer confirms the server has been patched. The NCSC says all PHP versions are affected.
How do I check my PHP version?
Ask your host or developer. In WordPress, go to Tools, then Site Health, then Info, then Server to see the PHP version. That shows the version number only, so still ask your host whether the vendor fix has been applied.
Will updating a plugin or WordPress fix it?
No. The flaw is in PHP on the server, so the fix has to be applied by whoever manages the server or hosting account.
Does Cloudflare protect me?
Help Net Security reports that Cloudflare has published initial WAF rules for known exploit routes, available on all plans including free. A firewall rule reduces exposure but is not a substitute for updating PHP.
What if my site is on PHP 7.4 or 8.0?
Those versions no longer receive full upstream support. Ask your host about a vendor backport and plan an upgrade to a supported release.
What should I do if I think my site has already been compromised?
Contact your host and developer straight away, restore from a clean backup if needed, change all passwords, and if you do not have the skills in-house, use an NCSC-assured Cyber Incident Response provider, as the NCSC advises.
Sources
- NCSC: Critical security issue affecting PHP, 21 October 2026
- Help Net Security: PHP2Shell: Critical PHP vulnerabilities patched, update now!, 21 October 2026
