critical PHP security vulnerabilities: what you need to know

21 Oct 2026

Today, 21 October 2026, PHP released fixes for two critical security vulnerabilities, and the UK’s National Cyber Security Centre (NCSC) has urged organisations to act immediately. If your website runs on PHP, it needs updating. Here’s what the issue is, what it could mean for your business, and what we at Wirebox are doing about it.

What is PHP?

PHP is the programming language behind a large share of the web, including popular platforms such as WordPress. It runs on the web server, building your pages, talking to your database and handling forms before anything reaches a visitor’s browser. Because it sits at the heart of your site, a flaw in PHP is a flaw in your website.

What are the vulnerabilities?

The two issues, CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 out of 10 for severity. Under certain conditions, an attacker could use them to run their own commands on a web server without needing a password or login.

In technical terms, the flaws involve how PHP handles running out of memory and cleans up after each request, which can leave memory in a corrupted state an attacker can exploit. The key point for website owners is simple: the NCSC says all versions of PHP are affected, so every PHP site should be updated.

What are the risks?

An unpatched website could be taken over by an attacker. In practice that could mean:

  • Website changes or defacement: pages altered, spam content added or the site taken offline.
  • Malware: malicious code installed that infects visitors or redirects them to scam sites.
  • Data theft: customer details, enquiries or account information accessed and stolen.
  • Data protection obligations: if personal data is accessed, you may need to report the breach to the ICO under UK GDPR.
  • Lost trust and search visibility: Google and web browsers often flag hacked sites as unsafe, turning visitors away.
  • Cost: cleaning up and recovering a compromised site takes far more time and money than preventing it.

The NCSC’s advice is to update as soon as possible. Where a site cannot be updated or protected, it suggests considering taking it offline until it can be.

What Wirebox is doing

We’re already working through every website on our support plans. For each site we are:

  1. Checking which version of PHP it runs
  2. lying the security update, or moving the site to a supported PHP version where needed
  3. Testing the site afterwards to make sure everything works as it should

Support clients don’t need to do anything. This work is covered by your monthly agreement, and we’ll email you once your site has been updated.

Not on a support plan?

If we built or host your website but you don’t have a support plan with us, your site won’t be updated automatically. Get in touch and we’ll check your site and quote for the update. For most sites on a recent PHP version this is a quick job; older sites may need a little more work to stay compatible.

If your website is managed by someone else, we’d recommend contacting your developer or hosting provider today to confirm it’s being updated.

Further reading