Critical PHP security flaws have left website owners with an urgent question: is their site protected? Organisations worldwide are checking their systems and installing fixes. Some have temporarily taken services offline while they deal with the risk.

You do not need to understand server code to take the first step. Contact the person or company that manages your hosting and ask for written confirmation that they have addressed both vulnerabilities.

Last checked: 22 October 2026. This is a developing story. Check the linked official advisories for later updates.

What are the PHP security flaws?

PHP is software that runs behind the scenes on many websites. It helps process requests and build pages before your browser displays them.

The PHP team announced two critical vulnerabilities on 21 October 2026: CVE-2026-109618 and CVE-2026-109619. They can allow an attacker to run code on an affected server without signing in. In simple terms, someone outside the organisation may be able to make the server carry out unwanted actions.

The official PHP security advisory lists fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting providers may also supply patched packages through their own vendors. Ask which fix applies to your setup.

Why did the alert spread worldwide?

Many different services depend on PHP. A problem in this shared software can therefore require action across many organisations at once.

The BBC explainer describes how researchers used AI to investigate the weaknesses. Its live coverage reports precautionary shutdowns and attempts to exploit the flaws.

• A shutdown can be a protective step, rather than proof of a breach.
• An attempted attack does not prove that an attacker got access.
• A website that loads normally is not proof that its server has the fix.

These distinctions matter when you explain the situation to customers. Share confirmed facts about your own service instead of repeating alarming claims about the whole internet.

Who should check for PHP security flaws?

Ask your technical team to check all systems that use PHP, including services outside your main website. The PHP advisory covers installations serving web requests, so this is not simply a problem with old-looking websites.

• Public websites and online shops.
• Customer portals and booking systems.
• Internal tools that use PHP.
• Third-party products that include PHP.

A managed hosting plan does not tell you whether the provider has completed this particular update. Request confirmation for each affected service.

How to respond to PHP security flaws

The UK National Cyber Security Centre guidance recommends finding affected systems, prioritising those exposed to the internet, and applying fixes. If a team cannot update or apply temporary measures promptly, it should consider taking the system offline.

1. Identify the owner. Decide who will coordinate the response: your host, developer or internal IT team.
2. Request patch confirmation. Ask whether both CVE numbers have been addressed across all relevant systems.
3. Agree a safe update plan. Have the responsible team handle backups, compatibility checks and any required service restarts.
4. Test the customer journey. Check login, forms, bookings, uploads and checkout where your website uses them.
5. Record the outcome. Keep the completion time, affected services and test results together.

For example, a booking site may show its homepage correctly while its booking form fails after an update. Testing that journey helps confirm that customers can still complete the task they came to do.

What if you cannot update immediately?

Ask your provider to follow the official advice for your environment. PHP says temporary measures only reduce certain risks; they do not replace a complete update.

If there are signs of compromise, involve a qualified incident response team. Installing a patch closes the vulnerability, but it does not automatically remove anything an attacker may already have added.

• Avoid copying server settings from unverified social posts.
• Keep a record of temporary measures and who approved them.
• Set a clear deadline for the full fix and follow-up checks.

Make the next security alert easier to handle

Use this incident to clarify who maintains each part of your website. Keep a simple record of your hosting provider, technical contact, software inventory and backup process.

Account security also needs separate attention. Our guide to logout and user sessions explains another part of protecting access to online services.

For this alert, start with one clear question to your provider: “Have you applied the fixes for both PHP vulnerabilities to every service we use, and can you confirm the checks are complete?”