Critical PHP security warning business leader brief and actions
Is my business exposed to the PHP security threat without knowing it?
Two newly discovered security vulnerabilities is leaving many business websites, applications and sensitive data exposed to cyberattack.
In this blog we’ll dive into what every business owner manager and director needs to know, what to do next and why this current risk is an important reminder to keep security patches up to date.
Your website is working and your business applications are running right? Nobody has reported a problem…yet. So, everything’s secure?
Not necessarily.
Two critical security vulnerabilities have just been discovered in PHP, technology used to power millions of websites and business applications worldwide.
Both have been given a severity rating of 9.2 out of 10, and could allow cybercriminals to gain access to vulnerable servers without needing a username or password.
The UK’s National Cyber Security Centre (NCSC) has issued an urgent warning, advising businesses to take immediate action. But there’s a bigger issue here.
What's happened, and why you should care?
On 21 October 2026, emergency security updates were released to address two serious vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619.
They affect PHP, a programming language widely used behind the scenes in websites, online stores, customer portals and business applications. You may never have heard of PHP, but there’s a good chance your business relies on it.
Popular platforms including WordPress, Drupal and Magento use PHP, as do many bespoke applications developed specifically for individual businesses.
The vulnerabilities could potentially allow attackers to execute malicious code on affected servers without having to log in. Eek.
Depending on the systems involved and the access an attacker gains, the consequences could include:
- Business disruption. Websites, customer portals or essential applications become unavailable
- Data exposure. Sensitive business or customer information could be accessed
- Financial loss. Costs associated with investigating an incident, restoring systems and interrupted operations
- Wider security risks. A compromised server potentially provides a route towards other connected systems
Not every website or application will be equally exposed. The risk depends on the PHP version, how the system is configured and how it can be accessed. But the message from the security authorities is clear, businesses shouldn’t wait to find out.
Question, do you actually know who’s responsible for keeping all your business systems secure, what processes are being followed, how often?
Five things every business should do now
You don’t need to become a cyber security expert to take control of the situation but you do need to make sure the right questions are being asked and answered.
1. Find out where PHP is being used
Ask your IT provider, website developer, web hosting company and software vendors to qualify if their products/services, websites, applications or servers are running PHP.
Prioritise systems accessible from the internet, particularly those handling customer information, payments or important business processes.
Don’t overlook older websites, unused applications or systems that are still running quietly in the background.
2. Confirm that the security updates have been applied
The PHP development team has released fixes for supported versions.
Your technical and web hosting providers should confirm whether your systems are affected, which versions they’re running and whether the relevant security updates have been installed. We can help review their response if needed Contact Us.
Importantly, updating WordPress plugins or your website’s appearance is not the same as updating PHP itself. You need confirmation that the underlying vulnerability has been addressed.
3. Check for unsupported software
Contact your software vendors to confirm whether their products are affected by CVE-2026-109618 or CVE-2026-109619 and whether an update is required. Just because your IT provider says they’ve run a scan to identify PHP services, doesn’t confirm that a system is unaffected, so getting that software vendor confirmation is still needed.
This includes applications and appliances that may have PHP built in.
Older PHP versions may no longer receive security updates. If your business is relying on outdated software, applying a routine patch may not be enough. A more substantial upgrade or migration could be necessary.
Unsupported systems aren’t just a technical inconvenience, they can represent an ongoing business risk.
4. Establish who's responsible
For every important business system, you must answer three questions:
- Who is responsible for keeping it updated?
- Who monitors it for vulnerabilities or suspicious activity?
- Who takes action when a critical security warning is issued?
If nobody can give you a clear answer, you’ve identified a security gap that must be reviewed and worth addressed to protect your business.
5. Act if something cannot be secured immediately
Where updates cannot be applied straight away, ask your technical provider to assess the risk and whether the affected service should be restricted, isolated or temporarily taken offline.
The NCSC has specifically advised organisations to consider taking affected systems offline where they cannot be adequately secured. It may be utterly inconvenient, but the consequences of a compromised system could be considerably worse.
The bigger picture and key lessons on security patch updates. Too many businesses assume someone else is looking after it.
Here’s a situation we regularly encounter, a business has an IT support provider managing its computers, Microsoft 365 and network. A separate web agency built its website three years ago and its hosting is managed by another company.
And, a bespoke business application was developed by someone who may no longer be involved or has left the business.
Everything works, so everyone assumes it’s being care for.
But who's actually checking that the underlying software is secure and up to date?
Just because your website is hosted externally doesn’t mean your hosting provider is responsible for updating everything running on it. And, just because you have managed IT support doesn’t necessarily mean your website, third-party applications or externally hosted systems are included.
Those gaps in responsibility can leave businesses exposed and it’s not always a lack of investment in cyber security that creates the greatest risk. Sometimes it’s simply not knowing what you’ve got, who manages it or whether it’s being maintained.
Cyber security is about stopping hackers and keeping your business running.
For most business owners and finance directors, the priority isn’t understanding the technical details of a vulnerability, it’s understanding the business impact.
What happens if your customer portal stops working? What would a day without a critical application cost? Could a security incident expose sensitive customer data, interrupt operations or damage the reputation you’ve spent years building? And, perhaps most importantly, how confident are you that somebody is identifying these risks before they become a problem?
Effective cyber security relies on your business IT being properly managed, maintained and protected. And, your people being threat aware.
That means having a clear understanding of your systems, regularly identifying vulnerabilities, keeping software updated and knowing who’s accountable for fixing problems.
It also means having reliable backups and tested recovery arrangements so that, if something does go wrong, your business can recover quickly. These are all fundamentals of good IT management. Yet, they’re often overlooked until something serious happens. Case in point, the PHP vulnerability impacting 70% of the world’s websites.
How commited helps businesses stay ahead of the risks
At commited, we help businesses across the North West take a proactive approach to managing IT, IT support and cyber security.
Our Technical Operations team is acting on the latest PHP security guidance and assessing the potential impact on environments we support.
Where we’re responsible for managing affected infrastructure or applications, we’re working with customers to identify and coordinate the necessary action.
For systems managed by third parties, we recommend contacting those providers urgently to establish what checks and updates have been completed. If you need help identifying and working with 3rd parties managing your assets contact us.
Don't wait for a security incident to discover the gaps
The latest PHP vulnerabilities are a timely reminder that even widely used, established technology can develop serious security weaknesses. But the businesses best placed to respond aren’t necessarily those spending the most on cyber security.
They’re the ones that know what systems they have, understand where the risks lie and have clear responsibility for keeping everything secure. If you are unsure on any of this and want to button down you security posture a good first base is to book a free Cyber Risk Review with one of our experts. You may then wish to consider Cyber Essentials assessment and certification to evidence to your customers, supply chain and insurance partners you position on cyber security.
Security advisory updated: 22 October 2026.
*Technical references: UK National Cyber Security Centre (NCSC), PHP Security Team and NHS England Cyber Alerts.
Newsletter
Subscribe for monthly IT advice and a chance to get Co-Op Live tickets.