On 21 October 2026, the PHP development team released an urgent security advisory identifying two vulnerabilities that could allow attackers to gain control of a website's server without requiring login credentials.
For businesses relying on their websites for customer enquiries, online transactions or day-to-day operations, this is an update that shouldn't be overlooked.
PHP is one of the most widely used programming languages for websites, including platforms such as WordPress.
The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code remotely.
In simple terms, an attacker could potentially compromise a vulnerable web server without needing a username or password.
The consequences could include:
With the vulnerabilities rated critical, businesses should treat patching as a priority.
If your website or web application relies on PHP, your organisation may be exposed.
This doesn't necessarily mean your website has been compromised. However, it does mean your website's underlying technology needs to be checked.
Importantly, you don't need to understand PHP or manage your own website to take action.
Your website developer, hosting provider or IT team should be able to confirm whether your environment is protected.
The PHP development team has released security patches addressing both vulnerabilities.
Businesses should contact their website developer or hosting provider and request confirmation that their website is running one of the following patched versions:
Alternatively, an appropriate vendor-patched equivalent may be available.
If your website is running PHP 8.1 or older, it's time to discuss upgrading to a supported version, as these older versions no longer receive standard security updates from the PHP project.
Simply assuming your hosting provider handles security updates isn't enough. Ask for confirmation that the patch has been applied.
A business website is often treated as a marketing asset rather than part of its IT infrastructure.
But websites can connect to customer databases, payment systems, internal applications and other business-critical services.
When vulnerabilities exist in the underlying technology, the potential impact can extend well beyond a website being temporarily unavailable.
This is why proactive vulnerability management, regular patching and visibility across your technology environment are essential parts of a strong cyber security strategy.
At Secure State Consultants, we regularly reinforce the importance of keeping business systems updated and understanding where potential vulnerabilities exist.
Cyber security isn't just about responding when something goes wrong. It's about identifying risks early and taking practical steps to reduce exposure.
If you haven't spoken to your website developer or hosting provider recently, now is a good time to start that conversation.
Not sure whether your business is protected? Get in touch with the Secure State team to discuss your cyber security posture and how we can help you stay ahead of emerging threats.
Protect. Prevent. Prevail.
Reach out to chat about your goals, challenges, or just to get a fresh perspective on your IT. Our team is ready to listen.
