Update, 22 October 2026: the emergency PHP release is out. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that can allow unauthenticated remote code execution. The PHP project says all PHP users should update immediately. Find out whether your website or business applications use PHP, confirm who is responsible for updating it, and check the fix has been applied.
Source: php.net security advisory and release announcements (21 October 2026) and the NCSC. The 9.2 score was given in the PHP project’s 20 October pre-announcement.
What has been announced?
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities: CVE-2026-109618 (remote code execution through out-of-memory corruption) and CVE-2026-109619 (remote code execution through stale global state). Both can allow an attacker to run code without logging in. The PHP project says the risk applies to all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and that updating is the only complete fix. The NCSC urged UK organisations using PHP to prepare for immediate updating and, if that is not possible, to consider taking affected systems offline until they can be fully mitigated.
Running an older version? PHP 8.1 and older no longer receive updates from the PHP project; the advisory links to minimal source fixes for 7.4, 8.0 and 8.1. If your site is on one of those, ask your host about moving to a supported version. PHP 8.2 reaches end of life on 31 December 2026.
What is PHP, and could your business be using it?
PHP is software that runs behind the scenes on web servers and helps websites and applications work. Your business may be using it without anyone on your team having installed it. WordPress, many content management systems, online shops, customer portals and booking systems all run on PHP, and so do a lot of third-party products that bundle it.
A website that looks and works normally still needs checking. If you run WordPress, you can see your current PHP version in the dashboard under Tools, Site Health, Info, Server. That tells you what is running today, but not whether your host will patch it or when.
What should your business do now?
1. Confirm who owns the update
Ask your host, website developer or IT provider: do we use PHP, which versions are running, who applies the emergency update and how will they prove we are protected? Make sure one named person is accountable.
2. Prepare to patch promptly
Backups, access and a deployment plan should be ready before the fix is released. After updating, verify the running PHP version and test forms, logins and checkout pages.
3. Plan temporary protection
If a system cannot be updated promptly, ask what effective mitigation exists. The NCSC advises considering taking the system offline until it can be fully mitigated.
4. Check for suspicious activity
Review logs and look for unexpected changes, unfamiliar accounts or unusual server activity. A patch closes the door, but you also need to know whether anyone has already walked through it.
5. Do not forget third-party products
The NCSC also points to vendors whose appliances or services bundle PHP. Watch for their security updates as well as your own.
6. Prioritise internet-facing systems
Websites, portals and anything reachable from outside your network come first, and should be monitored closely for malicious activity.
Is updating WordPress enough?
No. Updating your content management system, themes or plugins does not update PHP. PHP is part of the underlying server software, and it is normally patched by your hosting company or server administrator. Ask your provider to confirm in writing that the server software has been checked and that the relevant PHP security fixes have been applied.
Updating is also only half the job. Applying a patch should be accompanied by checking whether anything suspicious has already happened.
Why a fast response matters
When a patch is published, the vulnerability details usually become public too. That gives attackers a roadmap, and automated scanning for unpatched systems tends to begin quickly. This is why the NCSC is asking organisations to prepare before the release rather than after it. If you hold customer data, take payments or run a portal, the cost of being slow is far higher than the cost of a planned update.
It is also a good moment to check your wider patching habits. Cyber Essentials expects critical and high-risk security updates to be applied within 14 days of release, and a regular vulnerability assessment shows you which internet-facing systems are exposed before an attacker finds them.
Frequently asked questions
How do I know if my business uses PHP?
If you have a website built on WordPress or most other content management systems, an online shop, a customer portal or a booking system, it very probably does. Ask your website developer or hosting company to confirm which systems use PHP and which versions are running.
Do I need to take my website offline?
Not necessarily. The NCSC advice is to patch immediately when the fix is released, and to consider taking a system offline only if it cannot be updated or otherwise mitigated promptly. Talk to your provider about the options for your specific systems.
Will updating WordPress fix this?
No. WordPress, themes and plugins sit on top of PHP. The PHP fix has to be applied at server level, normally by your hosting provider.
What if I do not know who looks after my website?
Establish that today. Check your hosting invoices, your domain registrar and any original developer contract. If you cannot find an owner, that gap is itself a risk, and it is something ABCOM can help you resolve.
Where can I find the official advice?
The NCSC notice and the PHP project announcements, linked at the end of this article. Details of affected versions and fixes will be published with the PHP release.
Unsure who looks after your website’s underlying technology?
ABCOM supports businesses and charities across Sussex with practical IT and cyber security advice. We can help you understand the questions to ask and coordinate next steps with your hosting company or website developer. Call us on 01444 871 200 or email hello@abcom.co.uk. Your first IT review is free.
Book a free 20-minute callOfficial updates
Published 21 October 2026 and updated 22 October 2026 using the php.net advisory. Check the official sources for the latest guidance. Related reading: our cyber security services and managed IT support.
Related FAQs
Plain-English answers to the questions this article raises:
Do not just read it. Act on it.
Reading is the easy part. Book a free IT review and we will tell you, in plain English, where your business stands and what to fix first.
