Last updated 23rd October 2026
Two vulnerabilities in PHP, which the NCSC describes as a critical security issue, could let attackers run commands on a web server without logging in (CVE-2026-109618 and CVE-2026-109619). The NCSC says all versions of PHP are affected. UK organisations should identify where PHP runs, starting with internet-facing systems, and update to the latest fixed version as soon as possible.
On 21 October 2026, the National Cyber Security Centre (NCSC) urged UK organisations to take immediate action on a critical security issue affecting PHP. PHP has published a security update to fix two linked vulnerabilities.
Both relate to how PHP behaves when it runs out of memory. Under certain conditions, an attacker could use this to corrupt memory and achieve unauthenticated remote code execution. In plain terms, someone outside your business could potentially run commands on a server running PHP without needing to log in.
The issue has been fixed, but only organisations that apply the update are protected.
Possibly, even if you’ve never heard of PHP. It’s used by around 70% of the websites whose server-side language can be identified, according to W3Techs, and it’s built into many other products too. You might be running it through:
The NCSC says all versions of PHP may be affected, not just old ones, so don’t limit your search to outdated installations.
Start with the systems that face the internet, as they carry the most risk. Then work through:
If nobody can give you a confident answer, treat that as the first problem to solve. Websites built years ago by an agency that no longer exists, or a system you assumed a supplier was looking after, are the places that tend to get missed.
The NCSC’s priority actions are:
Is my website at risk from the PHP vulnerability?
Possibly. The NCSC says organisations using any version of PHP are affected, and PHP runs a huge number of websites and web applications. If your website, customer portal or another system uses PHP and hasn’t been updated to the latest fixed version, it may be exposed. Internet-facing systems are the priority.
Do I need to update PHP?
Yes. The NCSC highly encourages all organisations to update to the latest fixed version of PHP, starting with internet-facing systems. Anyone on an older version should move to a fully supported one.
How do I know if my website uses PHP?
Ask your web developer or hosting provider which sites and applications run PHP, and which version. Check your IT documentation, and ask your suppliers whether their products include PHP. The NCSC-NL list of software products with a PHP dependency can also help you spot affected software.
Should I take my website offline?
Only if you can’t update or apply the PHP Foundation’s temporary mitigations quickly. The NCSC’s advice is to consider taking the system offline until it can be fully mitigated.
What are CVE-2026-109618 and CVE-2026-109619?
They are two linked PHP vulnerabilities that both relate to how PHP behaves when it runs out of memory. Under certain conditions, an attacker could use them to corrupt memory and achieve unauthenticated remote code execution. Both have now been fixed in updated versions of PHP.