Critical PHP Vulnerabilities: What UK Businesses Need to Do Now
Published by Prestige Cyberguard | 22 October 2026
On 21 October 2026, the National Cyber Security Centre (NCSC) issued an urgent alert to UK organisations: two critical vulnerabilities have been found in PHP, and the fixes need to be applied immediately.
If that sounds like a problem for developers only, it isn't. PHP is the programming language behind a huge share of the web, including platforms such as WordPress. If your website, online shop, customer portal or booking system was built by a third party, there is a good chance it runs on PHP, and you may not know it.
Here is what has happened, who is affected, and what you should do today.
What has happened?
The PHP Foundation announced on 20 October that a security release was coming to address two vulnerabilities, both rated critical (9.2 out of 10 on the CVSS v4 scale). The NCSC published its UK alert the following day, urging organisations to prepare before the fixes landed rather than waiting. PHP has now released the security updates.
The two issues are tracked as:
• CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partly set up.
• CVE-2026-109619: internal request data can survive after the memory behind it has been freed.
In plain English: both are memory-handling flaws that, according to the NCSC, could allow an attacker to run commands on a web server running PHP. That is the kind of weakness that leads to website takeover, data theft and ransomware.
The NCSC says all versions of PHP may be affected. Do not assume you are safe because you are not running an old version.
Why this matters for your business
Most SMEs do not run their own web servers. But you are still exposed if:
• Your website or online shop is built on a PHP-based platform such as WordPress
• A web agency, developer or hosting company manages your site for you
• You use software or appliances from third-party vendors that bundle PHP inside them
That last point is easy to miss. The NCSC specifically warns that PHP can be embedded in other products, and its Dutch counterpart, NCSC-NL, has published a list of software products with a PHP dependency that may be affected.
This is also a supply chain issue. If a supplier of yours is compromised through an unpatched PHP system, the impact can reach your data and your customers. We covered why supply chain risk is now a regulatory and commercial concern in our posts on the Cyber Security and Resilience Bill and the Cyber Resilience Pledge.
What to do today
1. Find out where PHP is used. List every website, application and service you run or rely on, and ask who built and hosts each one. The NCSC advises prioritising anything internet-facing.
2. Contact your web agency or hosting provider. Ask them directly: are we running PHP, has the security update been applied, and when? Get the answer in writing.
3. Apply the update. If you manage your own systems, update to a version containing the fix. If you cannot update straight away, the PHP team has published temporary mitigations.
4. If you cannot fix it, consider taking it offline. The NCSC has said that where immediate remediation is not feasible, taking the system offline until it is mitigated is an option to consider. For a brochure website, that may be a small price to pay.
5. Monitor for suspicious activity. Watch internet-facing PHP systems for anything unusual, and keep checking for updates from vendors whose products may include PHP.
6. Keep watching the NCSC page. This is a fast-moving situation and the NCSC is updating its guidance. Check it regularly over the coming days.
The bigger lesson: patching is a process, not an event
Alerts like this one are why security update management is one of the five core controls in Cyber Essentials. Under the scheme, critical and high-risk updates must be applied within 14 days of release, and failing to do so can mean failing the assessment outright.
The businesses that handle days like today calmly are the ones that already know what software they run, who looks after it, and how quickly updates get applied. The ones that struggle are discovering for the first time that nobody is sure.
If you want to put a repeatable process in place, our guide to the Security Update Management control walks through it step by step, including a free PowerShell script on our GitHub (github.com/PrestigeCyberGuard) to help you check your update status. [Link to your Security Update Management post]
How Prestige Cyberguard can help
We help UK SMEs make sense of alerts like this and turn them into clear, practical actions: building an inventory of what you run, checking that your suppliers are patching, and getting you ready for Cyber Essentials certification, without jargon and without enterprise-level cost.
Not sure whether your website or suppliers are affected? Book a free 30-minute call and we will help you work out where you stand: hello@prestigecyberguard.co.uk
Source: NCSC, Critical security issue affecting PHP, 21 October 2026 (ncsc.gov.uk/news/critical-security-issue-affecting-php). This is a developing situation; check the NCSC page for the latest guidance.
Tags: PHP | Vulnerability | NCSC | Patch Management | Cyber Essentials | Supply Chain | UK SME | PrestigeCyberguard
