The UK’s National Cyber Security Centre (NCSC) has issued an urgent warning following the discovery of two critical security vulnerabilities affecting PHP, a technology used to power millions of websites and online applications.

Published on 21 October 2026, the warning highlights serious security flaws that could allow cybercriminals to execute malicious code on vulnerable web servers without needing login credentials. For businesses that rely on their websites for customer enquiries, online services or everyday operations, this is an important reminder of why keeping website software updated is essential.

At Ashdown Solutions, we’re taking proactive steps to protect the websites we host and support. However, businesses managing their own websites, or using hosting without ongoing support services, may need to take additional action.

What Is PHP and Why Does It Matter?

PHP is a widely used programming language that operates behind the scenes of many websites. It helps websites function by processing information, communicating with databases and generating content for visitors. Popular content management systems, including WordPress, Drupal and Joomla, use PHP to deliver their functionality.

Although most business owners won’t interact with PHP directly, there’s a good chance their website relies on it. Like any software, PHP requires regular updates to address security weaknesses, improve performance and maintain compatibility with other systems.

When vulnerabilities are discovered, developers release security patches to correct them. However, if those updates aren’t applied, websites can remain exposed to potential attacks.

What Has the NCSC Warned About?

The NCSC has highlighted two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.

Both vulnerabilities relate to how PHP manages computer memory. Under certain conditions, attackers could exploit these weaknesses to run malicious commands on affected servers without authentication.

In practical terms, a successful attack could potentially allow cybercriminals to:

• Gain unauthorised access to website systems.

• Access or compromise sensitive business information.

• Install malicious software or create unauthorised access points.

• Disrupt website functionality and business operations.

• Use a compromised server as a starting point for further attacks.

The PHP development team has released security updates addressing these vulnerabilities, but organisations must ensure the appropriate fixes are applied.

Importantly, these vulnerabilities are not limited to websites running older versions of PHP. The NCSC has advised organisations using any PHP version to assess their systems and apply the latest relevant security updates.

Is Your Business Website at Risk?

Any organisation operating a website or application that relies on an affected PHP installation could be exposed.

This is particularly relevant for small and medium-sized businesses that may not have dedicated internal IT teams or regularly review their website’s underlying software.

A website can appear to be functioning perfectly while still running outdated or vulnerable software.

Businesses should pay particular attention if:

• Their website hasn’t received maintenance or security updates recently.

• They’re using PHP 8.1 or an older version.

• Their website relies on plugins or themes that haven’t been updated.

• They’re unsure who is responsible for managing their hosting and security updates.

• Their website was developed several years ago and hasn’t undergone a technical review.

Even if your website uses a newer PHP version, this doesn’t automatically mean it’s protected. The latest security patches must still be installed.

For businesses handling confidential client information, such as legal practices, accountancy firms and financial services providers, maintaining website security is particularly important.

What Is Ashdown Solutions Doing to Protect Clients?

At Ashdown Solutions, we understand how important it is for businesses to have confidence in the security of their websites.

For websites that we both host and support, we will apply PHP security patches daily as part of our routine maintenance processes.

This ongoing maintenance helps ensure that important security updates are addressed promptly, reducing the time that supported websites may remain exposed to known vulnerabilities.

Regular website maintenance is an important part of cybersecurity. Rather than waiting until something goes wrong, proactively maintaining systems helps identify and address potential weaknesses before they become more serious problems.

However, it’s important to understand that hosting and ongoing website support are not necessarily the same service.

What If You Host Your Website With Us but Don’t Have Support Services?

If Ashdown Solutions hosts your website but you don’t have an ongoing support agreement, you may need to take action yourself.

If your website is running PHP 8.1 or older, you should contact your web developer as soon as possible.

Your developer will need to review your website and ensure that its core software, themes and plugins are compatible with a supported version of PHP (8.2 or later). This may involve updating your content management system, replacing outdated plugins or making changes to your website before upgrading PHP. Simply changing the PHP version without checking compatibility can sometimes cause website functionality to break, so it’s important that updates are managed carefully. You should also ensure that your website is running a PHP release containing the latest security fixes, even if it already uses PHP 8.2 or newer.

What If Your Website Is Self-Hosted?

If your business manages its own website hosting, the responsibility for applying security updates may sit with you, your web developer or your hosting provider.

We recommend contacting whoever manages your website to confirm:

• Which PHP version your website currently uses.

• Whether the latest PHP security patches have been installed.

• Whether your website’s core software and plugins are up to date.

• Whether any compatibility issues could prevent an upgrade.

• What ongoing maintenance arrangements are in place.

If you’re unsure who is responsible for these updates, now is a good time to find out.

What Steps Should Businesses Take Now?

Following the NCSC’s warning, there are several practical actions businesses should consider.

1. Check your PHP version

Ask your web developer or hosting provider to confirm which PHP version your website uses and whether it includes the latest security fixes.

2. Apply security updates promptly

Ensure affected PHP installations are updated to a patched release. The PHP development team has released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

3. Review website software and plugins

Check that your website’s core software, plugins and themes are maintained and compatible with your PHP version. Outdated components may prevent necessary upgrades or introduce additional security risks.

4. Review your website maintenance arrangements

Make sure you know who is responsible for applying security updates and monitoring potential vulnerabilities.

5. Seek professional advice if updates cannot be applied

If your website cannot be patched immediately, speak to your IT or hosting provider about temporary security measures. The NCSC advises that organisations may need to consider taking vulnerable systems offline until they can be secured.

Why Ongoing Website Maintenance Matters

This latest PHP security warning highlights a wider issue facing businesses: cybersecurity isn’t something that can be addressed once and then forgotten. New vulnerabilities are discovered regularly, and cybercriminals continually look for opportunities to exploit weaknesses in outdated systems.

For businesses without dedicated IT resources, it can be difficult to keep track of which updates are important, whether they’re being applied correctly and how they might affect existing systems. Ongoing website maintenance helps address these challenges by ensuring software is regularly reviewed, security patches are applied and potential problems are identified early. It also provides peace of mind that someone is taking responsibility for the technical upkeep of your website. While no security measure can guarantee complete protection, keeping systems updated is one of the most effective ways to reduce exposure to known vulnerabilities.

Protect Your Website With Ashdown Solutions

Your website is often the first point of contact between your business and potential customers. Keeping it secure is essential for protecting your information, maintaining customer trust and supporting business continuity.

The latest NCSC warning demonstrates why businesses should never overlook website maintenance and security updates.

At Ashdown Solutions, we provide practical IT and cybersecurity support to help businesses understand their risks and strengthen their defences.

Whether you’re unsure which PHP version your website is running, concerned about outdated software or looking for ongoing website support, our team is here to help.

Don’t wait until a security vulnerability becomes a business problem. Get in touch with Ashdown Solutions today to discuss your website security and ongoing IT support requirements.

 

www.ashdownsolutions.co.uk

Official Guidance and Further Reading

For full technical details and the latest recommendations, read the official National Cyber Security Centre guidance:

Critical Security Issue Affecting PHP – NCSC

Businesses can also consult the official PHP security updates at www.php.net.