What the PHP security flaw means for small websites and how to check yours
Two critical bugs in the language behind much of the web have been patched. The National Cyber Security Centre says anyone running PHP should update now.
Website owners across the UK are being urged to check their hosting after two serious flaws were found in PHP, the programming language that sits behind a large share of the world's websites. The PHP project released fixes on 21 October, and the National Cyber Security Centre (NCSC) has told organisations of every size to install them, or take affected systems offline if they cannot.
Organisations including the Wikimedia Foundation, which runs Wikipedia, and the Office for Budget Responsibility temporarily took systems or websites offline as a precaution while they applied fixes. Many sites were back up by Thursday, and as of Friday there were no confirmed reports of a successful attack using the flaws.
What PHP does
PHP runs on the web server, not in your browser. When you load a page, it gathers the information the page needs, such as product listings or blog posts, and assembles it before sending it to you. It has been in use since the 1990s and underpins WordPress, Drupal and many online shop systems, as well as the control panels used by hosting companies and some network equipment.
That spread is the reason for the alarm. Many small businesses, clubs and charities run a WordPress site without ever thinking about the software underneath.
What went wrong
The two bugs, catalogued as CVE-2026-109618 and CVE-2026-109619, are in PHP itself rather than in any particular website. Both concern how PHP handles memory between requests. Under certain conditions an attacker could send a specially crafted request and run their own commands on the server, without needing a password. The PHP project rates both at 9.2 out of 10 for severity and says the risk is highest on servers using the older mod_php setup.
The flaws were found with the help of advanced AI tools by researchers at the security firms Wiz and Calif. Details leaked online before the planned announcement date, which forced an early release of the fixes.
How to check your own site
The answer depends on how your site is hosted.
- Managed or shared hosting. Most website builders and managed WordPress hosts update PHP for their customers. Check your provider's status page or support notices, or ask them directly whether they have applied the October fixes.
- Your own server or virtual machine. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Version 8.1 and older no longer get official updates, so the NCSC advises moving to a supported version. Some Linux distributions ship their own patched packages.
- Devices and appliances. The NCSC notes that PHP is bundled inside some routers, firewalls and other products, so watch for firmware updates from those suppliers.
If updating straight away is not possible, the PHP project has published temporary configuration changes, though it says updating is the only safe fix. The NCSC also recommends checking any system that stayed exposed for signs of intrusion, using a certified incident response company if you lack the skills in house.
Small organisations can sign up to the NCSC's free Early Warning service, which alerts UK organisations when their networks show signs of known threats.
