Critical PHP security issue: what the NCSC alert means for your website

On 21 October 2026 the National Cyber Security Centre (NCSC) issued an alert encouraging UK organisations to take immediate action on a critical security issue affecting PHP. If your business has a website, there is a good chance it runs on PHP, so this one is worth ten minutes of your time.

What has happened?

PHP has released a security update for two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. In the NCSC's words, the issue "may allow attackers to execute commands on any web server running PHP".

In plain terms, an attacker can send requests that push PHP to run out of memory at exactly the wrong moment. That leaves PHP's internal memory in a corrupted state, and under certain conditions the attacker can use it to run their own code on your server. The NCSC describes this as unauthenticated remote code execution: the attacker does not need a password, an account or any prior access to your systems.

The two vulnerabilities are:

CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partly set up. The clean-up that runs afterwards can then treat that invalid data as valid.
CVE-2026-109619: internal state belonging to one request can survive after its memory has been freed. A later request handled by the same server process may then use that stale state.

The PHP project's own security advisory says the risk is highest for servers running PHP as an Apache module (mod_php), where it has demonstrated an exploit that is triggered before any of the website's own code runs. That detail matters. Keeping WordPress and its plugins up to date is still essential, but it will not fix this. The fix is an update to PHP itself, on the server.

Why this matters for small businesses

PHP is one of the most widely used languages on the web. WordPress is written in it, and so are WooCommerce, Joomla, Drupal and Moodle, along with a great many booking systems, client portals and bespoke business applications.

It also turns up in less obvious places. The NCSC points out that some appliances and third-party services bundle PHP inside them, so a product you have never thought of as a "PHP system" could still be affected. The Dutch NCSC (NCSC-NL) has published an inventory of software products with a PHP dependency that may be affected.

And because every version of PHP is affected, this is not only a problem for old, neglected websites. A site that was fully up to date last week still needs this update.

Which versions are fixed?

Organisations using any version of PHP are affected and all organisations are highly encouraged to update to the latest fixed version.
NCSC, Critical security issue affecting PHP

The fixed versions released by the PHP project on 21 October are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

If your server uses PHP packages supplied by a Linux distribution or a long-term support vendor, the version number may look different, because those vendors received the patches in advance and ship their own updated packages. Check with the vendor rather than relying on the number alone.

PHP 8.1 and older no longer receive updates from the PHP project. Some vendors provide their own fixes for older versions, but the safer route is to move to a fully supported version, which is also what the NCSC recommends.

What the NCSC recommends

The NCSC has set out six priority actions. In summary:

Find every system running PHP, starting with anything facing the internet. Don't only look for old versions, because all versions may be affected.
Update to the latest version of PHP, and keep watching for further updates.
If you can't update yet, apply the temporary mitigations published by the PHP project. These reduce the risk, but as PHP itself points out, only an update is a complete fix.
If you can't apply the mitigations either, or they would take too long, consider taking the system offline until it can be fixed.
Check for signs of compromise if you can't update or take the system offline straight away, including backdoors left by an attacker, before you upgrade. If you are not confident doing this yourself, the NCSC suggests an NCSC-assured Cyber Incident Response provider.
Watch for updates from your other suppliers, including for appliances and services that bundle PHP, and apply them as they arrive.

You can read the full alert on the NCSC website: Critical security issue affecting PHP.

What to do this week

Most small businesses don't run their own web servers, so for many of you the practical job is asking the right people the right questions.

If you have a website

Find out who hosts it and who looks after it. That might be a hosting company, a web developer, or both.
Ask them directly: which PHP version is the site running, and has the October 2026 PHP security update been applied?
If you manage your own hosting control panel, check the PHP version setting. If it shows 8.1 or older, talk to your developer about moving to a supported version, as older sites sometimes need changes first.
Get the answer in writing. If the site was exposed before the fix went on, ask whether it has been checked for signs of compromise.

Signs worth looking for include administrator accounts nobody recognises, files or pages nobody created, and settings that have changed without explanation.

Beyond your website

List the other web-based systems you rely on: booking systems, client portals, intranets and any software hosted on your own server.
Check for software and firmware updates on network devices and appliances, since some products bundle PHP.
If your organisation is in the UK, sign up to the free NCSC Early Warning service, which notifies you of potential threats on your network.

How we can help

Keeping software patched is one of the five technical controls behind Cyber Essentials, and it is exactly the kind of job that slips when everyone is busy. Managed software updates are built into our IT Support plans, and our Cyber Security service includes vulnerability assessments that scan your systems, software and configurations for weaknesses attackers could exploit.

If you are not sure whether your website or systems are affected, get in touch. We can help you work out what runs PHP and put the right questions to your host or developer. If you suspect a system has already been compromised, contact us straight away: our incident response service helps you contain the damage and investigate what happened.

Book a cyber audit