PHP Security Flaws: What UK Businesses Need to Check

Critical security vulnerabilities in PHP have prompted urgent action from website owners, hosting providers and cybersecurity authorities. For businesses, the immediate questions are straightforward: does our website use the affected software, has it been secured and is there any evidence of unauthorised access?

The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to run malicious code on vulnerable servers without logging in. PHP released security updates on 21 October 2026, and the UK’s National Cyber Security Centre (NCSC) urged organisations to identify affected systems and take immediate action.

What Is PHP and Why Does This Matter?

PHP is software that runs on a web server, it helps websites generate pages, interact with databases and process information before displaying the results in a visitor’s browser.

Businesses may depend on PHP without managing it directly, it can sit underneath a website, an application or a third party product, making the hosting provider or software supplier an important part of the response.

WordPress has confirmed that these vulnerabilities concern the underlying PHP software, updating WordPress alone does not resolve them and no WordPress update was required or planned specifically for these issues.

Website owners need to confirm that their PHP installation has been patched.

What Caused the Security Problem?

The flaws involve how PHP handles memory and errors.

The first vulnerability concerns situations where PHP reaches its configured memory limit while processing a request. An interruption at a particular point can leave incomplete internal data that PHP subsequently treats as valid.

The second concerns internal information remaining after the memory supporting it has been released. A later request handled by the same server process may then use that invalid information.

Under exploitable conditions, these weaknesses can allow an attacker to execute code on the server. The PHP Foundation explains that both flaws affect central parts of the software, which made developing fixes particularly challenging.

The Foundation also acknowledged that early signs of the first problem had been identified in 2024. At that stage, no concrete route to exploitation had been established. Competing approaches to fixing it introduced concerns about compatibility, performance and other security risks.

Limited specialist resources and difficulties reaching a decision contributed to the delay.

Why Were Websites Taken Offline?

The urgent response across Europe reflected the potential seriousness of the vulnerabilities.

European cybersecurity authorities advised organisations to patch affected systems immediately and consider isolating exposed applications where a fix could not be applied promptly.

Taking a website offline can therefore be a protective decision, an unavailable website does not, by itself, establish that attackers gained access or stole information.

The NCSC advised organisations to consider taking systems offline where updates or temporary mitigations could not be applied quickly enough.

Businesses should establish whether any disruption resulted from planned security work, a technical fault or a confirmed incident.

Which Businesses Need to Act?

Businesses using PHP should check their exposure, including those running relatively recent versions. This incident is not limited to websites that have been neglected for years.

The security releases issued on 21 October were:

PHP branch Security release
PHP 8.2 8.2.35
PHP 8.3 8.3.36
PHP 8.4 8.4.27
PHP 8.5 8.5.12

Older branches, including PHP 8.1 and earlier, no longer receive routine security updates from the PHP project.

Some operating system and extended support vendors provide backported fixes, so businesses should request confirmation from their provider rather than judge protection solely by a displayed version number.

What Should Businesses Look Out For?

There are two separate checks to make: whether the service works correctly and whether there is evidence of compromise.

Check Essential Website Functions

Following maintenance or a PHP upgrade, businesses should test:

Contact forms and enquiry notifications
Customer logins and account areas
Checkout, payment and booking processes
File uploads and downloads
Website administration and editing tools

Record any errors and when they first appeared. A broken page, failed form or unavailable editor needs investigation, but does not establish that these PHP vulnerabilities were exploited.

Investigate Unauthorised Changes

WordPress’s official incident guidance highlights warning signs such as unexpected user accounts, malware warnings, visible unauthorised changes and reports that a website is being used to attack other systems.

Businesses should escalate these findings to their hosting provider or security team. They are general indicators of possible compromise, rather than proof that this particular PHP incident was responsible.

A website that appears normal should still be checked for exposure. The NCSC specifically recommends assessing potentially exposed systems for evidence of compromise and looking for attacker installed backdoors where immediate updating or disabling has not been possible.

What Should Businesses Do Now?

Ask for clear confirmation from the hosting provider or IT supplier and establish which systems use PHP, which fixes have been applied and when the work was completed.

Check the underlying PHP installation, WordPress users can find their reported PHP version under Tools → Site Health → Info → Server. The hosting control panel may also provide this information, ask the host to confirm its patch status, particularly where vendor backports are used.

Include third party applications. CERT-EU warns that products embedding PHP may also be affected. A review should extend beyond the main business website.

Keep a record of suspicious activity, document symptoms, timestamps and recent changes. WordPress recommends this as an early step when investigating a suspected compromise.

Where an investigation may be needed, arrange evidence preservation before routine clean up removes useful information.

A Further Update Businesses Should Know About

On 23 October, PHP published an additional advisory concerning CVE-2026-115560. This involves an unusual combination of application code and session configuration.

PHP advised disabling the session upload progress feature until the next regular bugfix release, while explaining that applications which never change their session serialisation handler at runtime can leave it enabled. Businesses should ask their technical provider to assess this advisory alongside the original updates.

How Evidence IT Can Help

Installing security updates addresses known vulnerabilities; where unauthorised access is suspected, a further investigation may be needed to establish what happened and which systems or information were affected.

Evidence IT’s, IT forensic investigation services include the identification, preservation, collection, analysis and reporting of digital evidence, including evidence held on servers and computers.

This can support businesses that need a clearer understanding of a suspected incident and an evidence based response.

Concerned about suspicious activity following the PHP security incident? Contact Evidence IT to discuss your forensic investigation requirements.

CONTACT US FOR Digital Risk Management

You can be absolutely sure of a confidential, trustworthy and discreet service at all times, Evidence IT delivers results.