The UK’s National Cyber Security Centre (NCSC) has warned organisations about two critical security flaws in PHP, a programming language used by many websites and online services. The flaws are listed as CVE-2026-109618 and CVE-2026-109619.
PHP has released fixes. If you run a website, find out whether it uses PHP and make sure it is updated. The alert is aimed at organisations responsible for websites and servers; it is not a general instruction for people to stop browsing the web.
What’s the problem?
PHP runs behind the scenes on a web server. It helps websites display pages, handle forms and connect to databases. WordPress sites commonly rely on PHP.
The flaws involve what happens when PHP runs out of memory while handling a request. In certain circumstances, it may mishandle data during its cleanup process. An attacker could potentially use this to run commands on a server without logging in.
That does not mean every PHP website has been hacked. It does mean site owners and the companies managing their servers should treat the update as urgent.
What should website owners do?
- Find out where PHP is running. Check your website, servers and any third-party software or appliances that might include PHP. Pay particular attention to systems that can be reached from the internet.
- Install the fixed PHP release. Ask your developer or hosting provider which version your site is running and whether the security update has been applied. Keep PHP and other software up to date.
- Follow PHP’s additional security advice. If you cannot update straight away, check the PHP team’s advisory for temporary mitigations.
- Consider taking an exposed system offline if it cannot be protected. The NCSC advises organisations to consider this if they cannot apply the update or temporary mitigations in time.
- Check for signs of a break-in. If your site could not be updated or protected promptly, assess it for suspicious activity. Get specialist help if you are unsure how.
If you use managed hosting, contact your provider rather than assuming the update has already been installed. Ask whether your server was affected and what steps they have taken.
What if you’re just visiting websites?
This alert is mainly for the people and organisations responsible for running websites and servers. You can still take sensible precautions: keep your devices and browser updated, be wary of unexpected links, and use a different password for each important account.
A security issue in a website’s server software is not the same as a problem with your own phone or computer. The website owner or hosting provider needs to deal with the PHP update.
Website maintenance is part of security
Security updates only help once they have been installed. For a small business, it can be hard to keep track if nobody is responsible for checking updates, managing the server or responding to security issues.
If you run a WordPress site, managed hosting can help with routine maintenance and updates. Find out more about managed WordPress hosting and care, and ask any provider you consider how they handle urgent security patches.
The key point is simple: PHP has released fixes, and organisations using it should identify affected systems and apply the updates as soon as possible. For website visitors, there’s no need to panic—but this is a useful reminder that the sites we rely on need regular care.