Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
—Yesterday (21 October) a critical security vulnerability affecting PHP was announced. PHP is the programming language behind a large share of the world’s websites, including many built on popular content management systems such as Wordpress and similar platforms. The UK’s National Cyber Security Centre (NCSC) has issued an alert urging organisations to act immediately.
Most of our websites use PHP.
What’s the problem?
In the worst case, an attacker could take control of a web server and run their own commands on it, without needing a password or any action from a site owner. That could mean stolen data, a defaced or hijacked website, or malicious software being installed.
The PHP developers have released fixed versions, and the NCSC advises that all organisations apply them.
What we’re doing
Since the news broke we've been applying the required fixes across our infrastructure and servers.
We’ve installed the patched versions of PHP across many of the servers we manage overnight and we are continuing to work through the rest today.
Where a fix isn’t yet available for a server, we’ve applied a temporary mitigation that reduces the risk but it cannot be eliminated on older versions of PHP.
Where the risk is higher
Some websites are running on older versions of PHP that are no longer supported. Those versions will not receive a fix for this issue, so they remain vulnerable until the site is moved to a newer version. The same applies to sites on very old servers.
If your site is in this position, we will contact you directly to explain the risk and the options. Where the risk is high, we may recommend temporarily suspending the website until it can be secured. We’d rather take a site offline than leave it exposed at potentially greater risk.
What do you need to do?
Given the scale of this incident there's a lot for us to do with patching remaining servers and sharing updates with clients.
We’ll keep you informed as the picture develops.
If your site is hosted somewhere we don’t manage, please check with your hosting provider that they have applied the PHP update.
If you have any questions about your own website please feel free to contact us. We'll likely already know about your site and be actively working to ensure it's patched if it hasn't been already.
For reference, the issue is tracked as CVE-2026-109618 and CVE-2026-109619. You can read the NCSC’s alert here.
