Critical PHP Security Alert: What Businesses Need to Know
The Critical PHP Security Briefing
A serious security alert has been issued after two critical vulnerabilities were discovered in PHP, the programming language used by millions of websites. AI-assisted security research played a role in uncovering the flaws. Here’s what businesses and website owners need to know.
As the BBC reports on the issue, here’s what we know so far as of Thursday, 22 October 2026.
What has happened?
The PHP development team has released urgent security updates addressing two critical vulnerabilities that could allow attackers to execute code remotely on affected systems, potentially without needing to log in.
PHP is a programming language used to power millions of websites and web applications. Because it operates behind the scenes, businesses may rely on it without knowing it is part of their website or hosting setup.
The UK’s National Cyber Security Centre (NCSC) has urged organisations to identify systems running PHP, monitor them for suspicious activity and apply the relevant security updates as soon as possible.
Incident timeline
20 October — The PHP team publicly pre-announced two critical vulnerabilities and scheduled a coordinated security release early afternoon on the 21 October. [1]
20–21 October — CERT-EU and the UK NCSC advised organisations to identify exposed PHP installations, prepare immediate updates, and consider isolation or temporary shutdown where rapid remediation was not possible. [2,3]
21 October — in the early afternoon PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, urging immediate upgrades. [1]
21 October — Reuters reported precautionary outages affecting government and other public-facing websites in several European countries. NHS England published a high-severity cyber alert. [4,5]
What is PHP, and why does it matter?
Cybersecurity firm Wiz, whose researchers helped uncover the issue, has stated ”these findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”.
PHP stands for PHP: Hypertext Preprocessor. It is an open-source programming language used to build websites and web applications.
You may not recognise the name, but you may use PHP-powered services every day.
Websites and content management: Used internationally since the 2000s, PHP is widely used by online stores, Wikipedia and WordPress, the content management system behind millions of blogs and business sites worldwide.
Online services: It helps websites process requests, interact with databases and display dynamic content.
Business applications: It can sit behind customer portals, online shops and other web-based tools.
When you visit a website, PHP may be working on the server to retrieve information, process your request and generate the page you see in your browser.
That widespread use is why a vulnerability in PHP can have implications far beyond a single website. However, the level of risk depends on the PHP version, how it is deployed and whether the system has been updated.
What is the vulnerability, and what could happen?
The two vulnerabilities disclosed by the PHP team can allow unauthenticated remote code execution on affected systems. In simple terms, an attacker may be able to make a vulnerable server run malicious code without first signing in.
Depending on the system and the access available to the attacker, this could lead to further compromise, including unauthorised access to data or disruption to services.
That does not mean every website running PHP has been compromised, or that every PHP-powered website is equally exposed. The immediate priority is to identify affected installations, apply the correct updates and investigate any signs of suspicious activity.
The technical details
According to the NCSC, the vulnerabilities involve memory corruption and internal request data being handled incorrectly. Under certain conditions, these issues could be exploited to achieve unauthenticated remote code execution. Both vulnerabilities have now been addressed in the security updates.
CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialised. Request cleanup may then treat the invalid data as valid.
CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialisation resets it.
Which websites and organisations are affected?
The potential reach of this vulnerability is vast because PHP underpins everything from small business websites to major global platforms. The alert has prompted responses from public sector bodies and major corporations.
Several high-profile websites, select webpages and government portals have reportedly been taken offline as a safeguard. For example, according to yle, Finland temporarily shut down it’s government websites as a precaution for critical vulnerabilities.
The Local Government Chronicle has also stated that a host of local UK council and national government websites were taken offline amid cyber security fears triggered by a potential breach in Europe. Among those affected were Edinburgh City Council, Bristol City Council, Oxfordshire CC, Oxford City Council, the Local Government Association, the Electoral Commission and at least five London boroughs.
Precautions versus breaches
It is important to distinguish between a site being vulnerable, an organisation taking proactive measures by temporarily going offline, and evidence of an actual compromise. Taking a website offline as a precaution does not, in itself, mean it has been breached.
Key risks and NCSC guidance
The NCSC has urged organisations to identify PHP systems across their infrastructure, prioritising services exposed directly to the internet. This includes checking third-party tools, appliances and bundled software that may use PHP internally, rather than focusing only on primary, self-managed websites.
Who is most at risk? While large enterprises may face high volumes of attacks, poorly maintained websites can also be at risk, particularly those belonging to smaller organisations with limited IT support or security resources. Businesses should establish who manages their hosting and security updates.
What has happened since the vulnerabilities were disclosed?
The PHP development team released security updates on 21 October 2026. The updates address both critical vulnerabilities, and the PHP team has urged users to upgrade immediately.
Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The correct update will depend on the version and support status of the installation in use. To note, older versions still have the potential to be affected.
Applying the update is essential, but organisations should not assume that patching alone proves a system is safe. If a vulnerable server may already have been accessed, further investigation is needed to establish whether an attacker has left behind malicious code or other means of regaining access.
What can businesses do to safeguard themselves?
The NCSC recommends that organisations take the following steps:
Check: Find out whether your website, hosting or business applications use PHP. Remember that some third-party tools and services may use it behind the scenes.
Update: Apply the relevant security updates and restart after installing or contact your hosting provider or IT support team for help.
Monitor: Look for unusual activity and investigate any signs of compromise.
Review: Check third-party software and services for updates, and confirm that any fixes have been applied correctly.
If you cannot update an exposed system promptly, the NCSC advises considering taking it offline until it can be fully secured.
What steps have Evoke taken?
We patched the Evoke Telecom website on Wednesday, 21 October, and continue to monitor it for any unusual activity.
