On 21 October the National Cyber Security Centre (NCSC) published an alert about two critical security flaws in PHP. PHP released the fixes at 3pm UK time the same day, and the NCSC is asking UK organisations to apply them straight away.
If PHP means nothing to you, that's fine. Most business owners will never touch it directly. But there's a good chance something you rely on uses it, so it's worth ten minutes of your time this week.
What is PHP, and why does it matter?
PHP is the programming language that sits behind a large share of the world's websites. WordPress runs on it, as do Joomla, Drupal and Magento. So do many hosting control panels, customer portals, booking systems and the small web apps that businesses have had built for them over the years.
It also turns up in places you might not expect, bundled inside software and appliances from third-party vendors.
What has happened?
The two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) are rated critical by the PHP security team, scoring 9.2 out of 10. Public reporting describes them as allowing an attacker to run their own commands on a server running PHP. In plain terms, that could mean someone taking control of the web server behind your website.
Details leaked online a day before the planned announcement, which is why the release has been brought forward and why the NCSC has moved quickly. At the time of writing there are no confirmed reports of attacks in the wild, and no public exploit code. That's the window to get patched in.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older than those on a supported branch needs updating. The PHP project says any PHP installation serving web pages is at risk, and that updating is the only safe fix.
PHP 8.1 and older no longer get official updates. Some Linux distributions and hosting providers backport fixes to older versions, so check with yours, but the long-term answer is to move to a supported version. PHP 8.2 itself reaches end of life on 31 December 2026, so anything on 8.2 should be planned for an upgrade too.
Does this affect my business?
It might, if any of these apply to you:
- your website runs on WordPress or another PHP-based platform
- you have a web hosting account with cPanel or Plesk
- you run a customer portal, intranet or web app that a developer built for you
- you have an on-premises server hosting any kind of web application
- you use vendor software or appliances that include a web interface
Your Microsoft 365 or Google Workspace tenant is not affected by this. Those are run and patched by Microsoft and Google. The concern is websites and servers that you, your developer or your hosting provider look after.
What should I do?
- Make a list of anything that might use PHP. Start with your website, then anything else that is reachable from the internet.
- Speak to whoever manages each one. That might be your web developer, your hosting company or your IT provider. Ask them directly whether they are aware of the PHP update and when it will be applied.
- If you're on shared or managed hosting, check your provider's status page or support emails. Most will patch the underlying servers for you, but it's worth confirming rather than assuming.
- If something runs an old version of PHP that won't be patched, treat that as the priority. The NCSC suggests taking a system offline if it can't be fixed quickly. Upgrading, or moving it behind extra protection while you plan an upgrade, are the sensible options.
- Watch for updates from software vendors whose products include PHP, and apply them when they arrive.
None of this needs to be done in a panic. It does need to be done this week rather than next month.
How we can help
If you're not sure what your business runs, or who is responsible for it, that's a common position to be in, and it's exactly the kind of thing we help with. Speak to the team and we'll help you work out what's exposed and what needs updating.
You can also start with one of our free checks below. They won't tell you which version of PHP your website runs, but they're a quick way to see how your domain and wider IT setup look from the outside.
Want this handled for you? See Cyber security services.
Based in Brighton or Hove? We are too: see IT support in Brighton.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
