Critical PHP Vulnerabilities: What Businesses Need to Know

On 21 October 2026, the PHP development team released security updates addressing two critical vulnerabilities. These flaws could allow an attacker to execute malicious code on an affected server without needing to log in first.

The announcement is particularly relevant to businesses running websites, online services and applications powered by PHP, including WordPress websites.

But what exactly is PHP, which websites could be affected, and what should business owners do next? Here's a practical guide to help you understand the issue.

What is PHP, and why does it matter to my business?

PHP is a programming language used to build and run websites and web applications. It operates on the server that delivers your website to visitors.

Popular platforms, including WordPress, use PHP to handle tasks such as displaying website content, processing requests and interacting with databases.

You don't need to understand how PHP works to run a business website. However, it is important to know that your website depends on several layers of software working together. These may include the hosting server, PHP, your content management system, themes and plugins.

If a vulnerability affects one of these layers, it may introduce a security risk even if the website itself appears to be working normally.

What are the recent PHP security vulnerabilities?

The PHP security release announced on 21 October 2026 addresses two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.

In straightforward terms, these flaws involve errors in how PHP manages memory and internal information while processing requests. Under certain conditions, an attacker could exploit these errors to run unauthorised code on a vulnerable server.

This is more serious than a minor software bug. If exploited successfully, a vulnerability of this kind could potentially give an attacker access to systems or data handled by the affected server.

The PHP project has released security updates to address the issues. You can read the official announcement and technical details here:

• Official PHP security announcement
• Joint security statement from European cyber security agencies

The key takeaway is simple: if your website uses an affected PHP installation, it is important to establish whether it has been updated to a fixed version.

Could my business website be affected?

Potentially, yes. The vulnerabilities affect PHP installations that serve web requests, so the issue is not limited to WordPress or to one particular type of website.

If your business has a WordPress website, an online shop or another PHP-based application, the version of PHP running on its hosting server is worth checking.

The PHP project has published fixes in the following releases:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

These are the specific fixed releases announced for the affected branches. If you are using one of these branches, check that your installation is running the relevant fixed release or a later patched version.

Older PHP versions may no longer receive security updates from the PHP project. Some hosting providers and software distributors maintain their own packages and may supply fixes separately, so the version number alone does not always tell the whole story. Check with your website host.

You can check the PHP project's official supported versions information for details about ongoing support.

It's also worth remembering that updating PHP needs to be handled carefully. Older websites, themes or plugins may not be compatible with a newer version, so compatibility should be checked as part of the update process.

How can I check which PHP version my website uses?

If you use WordPress, there is a straightforward way to check the version reported by your website.

1. Log in to your WordPress dashboard.
2. Navigate to Tools → Site Health.
3. Open the Info tab.
4. Expand the Server section.
5. Look for the PHP version information.

You can also check your hosting provider's control panel or ask the company responsible for hosting your website.

However, there is an important distinction: knowing your PHP version is only the first step. 

If you are unsure, contact your hosting provider and ask them to confirm the status of your PHP installation against the latest security advisory.

What should I do if my website is running an affected version?

First, don't panic. Finding out that your website may be affected does not automatically mean it has been compromised. It does mean that you should establish the facts and act promptly.

Here are the practical steps to take.

1. Contact your hosting provider

Ask whether your hosting environment is affected by CVE-2026-109618 or CVE-2026-109619, and whether the appropriate security updates have been applied.

If your hosting is managed by a third party, they may be responsible for maintaining the underlying PHP environment. Confirm this rather than assuming the update has already happened.

2. Arrange the necessary security update

If your installation is vulnerable, arrange for the relevant security fix to be applied as soon as possible. The correct approach will depend on your hosting setup, the PHP version in use and any compatibility requirements.

Avoid changing production settings without a suitable plan, particularly if your website supports customer enquiries, bookings or online transactions.

3. Check website compatibility

Before changing PHP versions, check that your content management system, themes and plugins support the target version. Where possible, test the update on a staging website before applying it to the live site.

Compatibility testing should not become a reason to leave a critical vulnerability unaddressed indefinitely. If you cannot apply the fix promptly, ask your hosting provider or IT team about appropriate temporary protection.

4. Check backups and recovery arrangements

Make sure you have a recent backup of your website files and database, and that you know how to restore them if required.

A backup is useful only if it can be restored successfully. If you haven't tested your recovery process recently, this is a good opportunity to review it.

5. Consider whether further investigation is needed

If your website was exposed while running a vulnerable version, updating it is essential, but an update alone cannot establish whether an attacker accessed the system beforehand.

If there are signs of suspicious activity, unexpected files or unexplained changes, ask your hosting provider or a qualified security professional to investigate. Preserve relevant logs and evidence rather than immediately deleting files or rebuilding the server.

The UK National Cyber Security Centre provides further guidance through its website.

Does updating WordPress fix the PHP vulnerability?

No, WordPress uses PHP, PHP is not part of Wordress.

WordPress itself is built using PHP, but the vulnerabilities described in this advisory affect the PHP runtime running on the server. The WordPress project has stated that no separate WordPress update is required specifically to fix these PHP vulnerabilities.

Updating WordPress, themes and plugins remains good practice, but it is not a substitute for making sure the underlying PHP installation is patched.

For this particular issue, the website owner or hosting provider needs to confirm that the server's PHP environment has received the appropriate fix.

How can I reduce the risk of similar website security problems in the future?

There is no way to eliminate every security risk, but a few consistent practices can make a meaningful difference.

Keep software supported and updated. This includes the hosting environment, PHP, WordPress, themes, plugins and other applications your business relies on.

Know who manages your website. Make sure you understand who is responsible for hosting, software updates, backups and security monitoring. These responsibilities can be split between several providers.

Maintain reliable backups. Keep appropriate backups of website files and databases, and periodically check that they can be restored.

Use strong account security. Protect website administrator and hosting accounts with unique passwords and multi-factor authentication where available. Limit administrative access to people who need it.

Review your website periodically. Remove unused plugins and themes, check that installed components are supported, and investigate unexpected changes.

Have a plan for urgent updates. Agree who will assess security alerts, contact the hosting provider, test compatibility and approve urgent changes. A clear process makes it easier to respond quickly when a new vulnerability is announced.

The WordPress security documentation provides additional advice on maintaining a more secure WordPress installation.

A final word: website security is an ongoing responsibility

The recent PHP vulnerabilities are a useful reminder that website security involves more than installing a security plugin or keeping the WordPress dashboard up to date. The underlying software and hosting environment matter too.

For small businesses, the practical priority is to understand who is responsible for maintaining each part of the website, establish whether the relevant security fixes have been applied, and make sure backups and recovery arrangements are in place.

If you aren't sure who manages your website's hosting or PHP updates, start by contacting your hosting provider or website administrator. Asking a few straightforward questions now can help you identify gaps before they become bigger problems.

Good IT guidance should help businesses understand their technology and make informed decisions. Keeping software maintained, knowing where to find reliable advice and having a clear plan for dealing with security issues are useful steps for any business that relies on digital systems.

Head over to our AUA page and see how we can help you and your business today!