Marketing & Operations
Claudia Sterling
Two critical flaws in PHP, the technology behind a huge number of business websites and systems, are making headlines. If your website or a system you rely on runs PHP, this belongs on the boardroom agenda, not just the technical desk.
What Has Happened
On 21 October 2026, the group that maintains PHP released emergency security updates for two critical flaws. They are tracked as CVE-2026-109618 and CVE-2026-109619, and are widely being referred to as PHP2Shell. PHP is a programming language that runs on servers behind a very large number of websites, web applications and business systems, which is why this has moved so quickly from the technical press into the mainstream news.
The UK’s National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA) have both urged organisations to act straight away.
What The Vulnerability Actually Is
Both flaws relate to how PHP handles its memory when a server is under pressure. In simple terms, if PHP runs out of memory at exactly the wrong moment, it can be left holding half-finished or leftover information from one request and then mistakenly reuse it for the next. Imagine a receptionist who is interrupted halfway through filling in one visitor’s paperwork, then accidentally uses that half-finished form when the next visitor arrives.
A skilled attacker can turn that confusion into something far more serious. The technical term is remote code execution: the ability to make a server run commands of the attacker’s choosing, from anywhere, without needing a username or password. The PHP security team has rated both flaws 9.2 out of 10 for severity, which puts them firmly in the critical category.
Why This Belongs In The Boardroom
A website is often the most visible part of a business, but PHP also quietly powers customer portals, booking tools, internal applications and other systems that run on servers in the background. These frequently sit close to customer data, logins, payments and other business systems. If an attacker takes control of the server, the consequences are not just technical. Researchers warn that sensitive details held on a compromised server, such as passwords and access keys, could potentially be exposed, and that attackers can use that foothold to plant hidden backdoors for later.
We expect to see more of this, not less. Critical vulnerabilities like this one will keep making the news, and the question for any leadership team is no longer whether to care, but who is responsible for knowing whether the business is affected and how quickly they can find out.
Is Anyone Actually Attacking This?
Reports vary, and the picture is changing quickly. Details of the flaws reportedly leaked ahead of the planned announcement, some security vendors have reported attempted attacks, and CISA said it had not yet observed exploitation when it published its alert. The NCSC says it is continuing to monitor for impact on UK organisations. The sensible assumption is that attackers are already looking, and that waiting for confirmation is the wrong strategy.
Which Websites And Systems Could Be Affected?
A lot of websites run on PHP, and so do many business systems working quietly on servers, such as customer portals, booking and order systems and in-house tools. That is exactly why this matters so widely. If you are not certain whether yours do, that is the first thing to find out, and it is definitely something to check with your web developer or whoever looks after your servers and systems.
Any website, application or system that uses PHP to handle web requests is potentially affected, whichever version it is running. The NCSC advises finding every PHP system you have, not just the obvious ones. That includes:
Websites built on common content management systems such as WordPress, Drupal, Joomla and Magento
Hosting platforms and control panels such as cPanel and Plesk
Custom-built websites, web applications and business systems created by a developer or agency, such as customer portals, booking tools and internal applications
Appliances, software and services that bundle PHP behind the scenes, which are easy to overlook
Older websites and systems on versions of PHP that are no longer officially supported, which are the hardest to protect
How It Can Be Fixed
The proper fix is to update PHP to a patched version. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Your web developer, hosting provider or IT provider will know which applies to your website or system. Some hosting providers will apply the update for you, but others leave it to you or your developer, so it is worth asking rather than assuming.
If your website or system runs on PHP 8.1 or earlier, the situation is harder. Those versions are no longer officially supported, so there is no normal update available. Some hosting providers and vendors are offering their own fixed builds, but the lasting answer is upgrading to a supported version of PHP, which may mean the application or its plugins need some work to stay compatible.
If an update cannot be applied straight away, the NCSC points to temporary protections published by the PHP project, and a web application firewall can help reduce exposure in the meantime. These are stop-gaps rather than cures. Where a system cannot be updated or protected quickly, the NCSC and CISA both advise considering taking it offline until it can be.
What To Do This Week
Ask your web developer, hosting provider or IT provider whether your websites and systems run PHP, and which version.
Ask them to confirm in writing that everything running PHP has been updated to a patched version, or what the plan is if it has not.
Check the other systems you rely on, including customer portals, internal tools, your content management system, plugins, hosting control panels and any third-party software that may bundle PHP.
If a website or system is on an unsupported version and cannot be updated quickly, ask about protecting it with a web application firewall or taking it offline for now.
Ask whether anyone has checked for signs of compromise, particularly on internet-facing websites and systems that were exposed before the update was applied.
UK organisations can sign up to the NCSC’s free Early Warning service to be alerted to threats affecting their networks.
Our Take
A vulnerability like this is a reminder that your website and the systems behind your business are only as safe as the software quietly running underneath them, and that someone in the business needs to own the question of whether it has been updated. The businesses that cope best with moments like this are not the ones with the most technical staff. They are the ones who know exactly who to ask, and get a clear answer quickly.
If you are not sure whether your website, or a system you rely on, runs PHP, or you are not sure who to ask, that is a conversation worth having today. Get in touch and we will help you work out where to start.
