Critical PHP vulnerabilities: is your website at risk?

On 21 October 2026, the UK's National Cyber Security Centre (NCSC) issued an alert concerning two critical vulnerabilities affecting PHP, one of the most widely used programming languages for websites and web applications.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both received a CVSS v4.0 severity score of 9.2 out of 10, indicating a critical security risk.

According to the official NCSC security alert, attackers could potentially exploit these weaknesses to execute code remotely on vulnerable servers, even without valid login credentials.

Attempts to exploit these vulnerabilities, also known as PHP2Shell, have already been observed.

According to Amazon Threat Intelligence, an initial attempt was recorded on 17 October 2026, four days before the vulnerabilities were publicly disclosed. Following the release of the patches, AWS observed further attempts against its monitoring systems.

These findings confirm malicious activity, although they do not necessarily demonstrate that the attempts successfully compromised real-world systems.

The PHP development team has already released the necessary security updates.

Businesses and website owners should therefore check which PHP version their systems are running and apply the available security patches immediately.

What does remote code execution mean?

The technical term is Remote Code Execution (RCE).

It describes a vulnerability that can allow an attacker to execute instructions on a system through a request sent from outside.

In the case of these two PHP vulnerabilities, the issues involve memory management and internal information used while processing requests.

Under certain conditions, these problems can be exploited to compromise the server.

Potential consequences include unauthorised access, website modifications, exposure of confidential information and service disruption.

Running a vulnerable PHP version does not automatically mean that a website has been compromised. It does, however, indicate a security risk requiring prompt action.

Which websites and platforms could be affected?

PHP powers numerous web platforms, including WordPress, WooCommerce, Drupal and Joomla, as well as websites and applications built with custom frameworks.

The vulnerabilities affect the underlying PHP server environment and can involve different configurations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

According to the PHP development team, vulnerable installations processing web requests require attention.

Apache with mod_php is considered particularly exposed, as an attack has been demonstrated that can be triggered by an unauthenticated request before the application's code is even executed.

Importantly, WordPress has confirmed that these vulnerabilities affect the underlying PHP environment and that no specific WordPress core update is planned to address them.

This means a fully updated WordPress website may still be running a vulnerable PHP installation.

Attention must therefore also be given to web hosting, server configuration and infrastructure security updates.

For ecommerce businesses, the issue is particularly urgent: a security incident could affect website availability, commercial operations and business continuity.

Which PHP versions need updating?

The official PHP development team has released patched versions addressing both vulnerabilities.

Installations running earlier releases within these branches should be updated.

PHP 8.1 and older versions no longer receive regular security updates from the PHP project.

However, some hosting providers and software distributors may supply specific patches for these older releases through their own updates or backports.

For example, Plesk has confirmed the availability of patched builds for certain PHP 7.4, 8.0 and 8.1 installations on Linux.

In these cases, the PHP version number may remain unchanged. It is therefore important to check the installed build and confirm that the relevant security fix has actually been applied, working with the hosting provider where necessary.

Websites still relying on outdated PHP versions should nevertheless plan a migration to a fully supported release.

PHP 8.2 is also scheduled to reach end of life on 31 December 2026.

How to check your website's PHP version

The first step is to identify which PHP version is actually running in the production environment.

For WordPress websites, this information can usually be found under:

Tools → Site Health → Info → Server

The PHP version may also be displayed in the hosting provider's control panel.

Businesses using managed hosting should contact their provider to confirm whether the necessary security update has been applied.

For dedicated servers, VPS environments or custom infrastructure, the check should be carried out by the responsible technical team.

Before manually changing PHP versions, it is important to assess CMS, plugin, theme and application compatibility, with suitable backups and testing procedures in place.

The objective is to apply the security fix quickly while avoiding unexpected service interruptions.

What if you cannot update PHP immediately?

The NCSC identifies upgrading to a patched PHP version as the priority action.

Where an immediate update is not possible, the PHP project has published temporary mitigation measures designed to reduce exposure to certain attack methods.

These are technical measures that should be assessed and implemented by qualified personnel, as they do not eliminate the risk completely.

The NCSC also recommends considering taking vulnerable systems offline temporarily when updates or effective mitigations cannot be applied quickly enough.

For publicly accessible websites, the immediate priority is therefore to agree on a remediation plan with the hosting provider or infrastructure team.

A Web Application Firewall (WAF) may provide additional protection, but its presence should never be treated as confirmation that the underlying vulnerability has been fixed.

Why should businesses also check for signs of compromise?

Updating PHP addresses the vulnerabilities, but applying a patch does not automatically remove malicious changes that may have been introduced before the update.

For this reason, the NCSC advises organisations unable to update promptly to investigate suspicious access, unusual log activity and potential backdoors.

The need for these checks is reinforced by Amazon Threat Intelligence's findings.

Because the first exploitation attempts date back to at least 17 October 2026, AWS suggests using this date as the starting point for retrospective investigations, rather than limiting reviews to the date of public disclosure.

A security review may include checking anomalous requests, unauthorised file modifications and unexpected server activity.

If evidence of compromise is found, specialist incident response support should be considered before returning affected systems to normal operation.

Third-party components also deserve attention: some products may bundle PHP without the website owner being directly aware of it.

PHP security checklist: what should businesses check immediately?

For organisations managing corporate websites or ecommerce platforms, the priority checks are:

• PHP version: identify the installed release and, where necessary, the specific build, confirming that the security patch has been applied.
• Hosting: obtain confirmation of security updates from the hosting provider or internal IT team, including for older PHP versions.
• Compatibility: check that the CMS, plugins, themes and applications continue working correctly after the update.
• Internet-facing systems: prioritise publicly accessible websites and applications, paying particular attention to Apache with mod_php configurations.
• Security monitoring: review logs, suspicious access attempts and potential signs of compromise, including activity before 21 October.
• Third-party software: identify components that bundle PHP and may require separate vendor updates.

The two critical PHP vulnerabilities reported in October 2026 highlight how website security also depends on the infrastructure running behind the application.

For UK businesses, acting quickly helps protect sensitive information, service availability and operational continuity.

For ecommerce businesses, particularly with Peak Season approaching, it also reduces the risk of a technical security incident interrupting sales and commercial activity.

The immediate priority is to assess the current environment, coordinate with the relevant technical teams and apply the security updates that are already available.