UK organisations have been urged to check and update their web servers after a critical PHP security issue was disclosed on 21 October 2026. The National Cyber Security Centre (NCSC) says the flaws could, in certain circumstances, allow an unauthenticated attacker to execute commands on a server running PHP. The PHP development team has released fixes and is urging users to update immediately.

The warning matters to businesses, public bodies and website operators because PHP runs server-side code for many websites and web applications, including many content-management systems. It does not mean every site has been breached, but it does mean administrators should establish which PHP versions their systems use and confirm that the relevant fix has been applied.

What the PHP security warning says

The NCSC alert, published on 21 October, identifies two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The PHP team says the issues can, under certain conditions, lead to remote code execution without an attacker first logging in. One issue concerns memory handling after an out-of-memory condition; the other concerns internal state that may remain after memory has been freed.

These are server-side risks rather than a flaw that a typical visitor fixes in a browser. The practical response belongs with the organisation that manages the web server, its hosting provider or its technical support team.

Which PHP versions have security fixes?

The PHP project lists the following fixed releases for the supported branches:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

Organisations using Linux distributions, managed hosting or long-term-support packages should check the relevant vendor’s security notice, as patched packages may be delivered through that vendor. The PHP project also warns that PHP 8.1 and older no longer receive standard updates from the project, although some vendors may provide backported fixes.

Read the official PHP security advisory and release notes and the NCSC alert for UK organisations for the latest technical guidance.

What website owners should do now

1. Check every server that runs PHP

Do not check only the main website. Include staging environments, older applications, control-panel tools and internet-facing services that may use PHP behind the scenes. Ask the hosting provider which PHP version is active and whether the security fix has been applied.

2. Apply the vendor-approved update

Use the hosting provider’s or operating system vendor’s recommended update path. Site owners using WordPress should remember that updating WordPress core or a plugin is not necessarily the same as updating the PHP runtime on the server.

3. Review monitoring and access logs

Where a server could not be updated promptly, the NCSC advises organisations to assess whether there is evidence of compromise before or during remediation. If suspicious activity is found, seek specialist incident-response support rather than assuming that a software update alone resolves any earlier intrusion.

4. Treat temporary mitigations as temporary

The PHP team has published interim measures for some attack paths, but says updating is the only safe choice and that there are no complete mitigations. Administrators should not treat a configuration change as a substitute for installing a fixed release.

Why the warning matters beyond IT teams

A compromised web server can expose business information, disrupt online services or become a foothold for further attacks. That makes patch management a business-continuity issue as well as a technical task. Organisations should know who is responsible for PHP updates, how urgent alerts are handled and how quickly they can confirm that a fix is in place.

SeaIsleNews will continue covering developments in technology and cybersecurity. For now, the key message from the NCSC and PHP maintainers is straightforward: identify affected systems, apply the appropriate fixed release and investigate any signs of compromise.

Sources and further reading