Critical PHP Security Issue: What Website Owners Should Do

The National Cyber Security Centre (NCSC) has urged UK organisations to act on a critical security issue affecting PHP, the server-side software used by WordPress and many other websites and applications. PHP published security updates on 21 October 2026 for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

In certain circumstances, the flaws could allow an unauthenticated attacker to run commands on an affected web server. The issue is in PHP itself, so updating WordPress themes and plugins alone does not install the PHP security fix. Any organisation running PHP should identify where it is in use and check that the relevant fix has been applied.

Who needs to check their website?

The NCSC says organisations using any version of PHP should update to the latest fixed version. Start with internet-facing websites and services, but remember PHP can also be used by other applications, internal systems, and products that bundle it. A WordPress site is one example; it is not the only kind of PHP system that may need attention.

The PHP project lists fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting providers and Linux distributions may deliver fixes as vendor packages or backports, so the version number shown by a website alone may not tell the whole story. Check your provider’s security notice or ask them to confirm that the fix for both CVEs is installed. Older PHP versions that are no longer supported by the PHP project should be moved to a supported, patched version; some vendors may provide their own backported fixes.

What should you do now?

1. Ask your hosting provider which PHP version and security updates your website is using, and confirm that both CVE-2026-109618 and CVE-2026-109619 are addressed.
2. If you manage the server, identify all PHP systems, prioritising those reachable from the internet, and apply the latest fix recommended by your PHP vendor or operating-system provider.
3. If you cannot update immediately, consult the PHP Foundation’s temporary mitigations and your provider. These reduce exposure but are not a replacement for applying the security update.
4. If neither updating nor applying mitigations can be done promptly, the NCSC advises considering taking the system offline until it can be fully mitigated.
5. If you cannot update or disable the system straight away, assess it for signs of compromise before upgrading or applying mitigations. Get specialist incident-response help if you are not confident carrying out that assessment.

How CoreTechnics can help

We can help check your website and hosting setup, review WordPress plugins for known vulnerabilities, explain what we find in plain English, and move your site to secure hosting. We can also host other PHP websites and projects.

We’re making extra time over the next few days for urgent website moves. We can usually begin a migration and initial security checks within a few hours of first contact, depending on the website and the access available. To get started, you’ll need access to your WordPress website and your domain name. Please don’t send passwords through the contact form.

We’ll review your current hosting costs and do our best to match or beat them. Hosting prices depend on what your website needs and are subject to our minimum hosting price; we’ll confirm the cost before proceeding.

Sources and further reading

• NCSC: Critical security issue affecting PHP
• PHP: Security advisory and update information

Information in this article reflects the NCSC and PHP guidance available on 22 October 2026. Follow your hosting provider’s current instructions for your specific server and PHP package.