Critical PHP Security Alert (October 2026): What UK Businesses Need to Know

On 21 October 2026, a major website security alert prompted organisations around the world to review their systems urgently. Two critical vulnerabilities in PHP were disclosed, emergency fixes were released, and some government and business websites temporarily went offline as a precaution.

For business owners, seeing headlines about websites being taken offline is understandably concerning. But there is an important distinction: a vulnerability is not the same as a confirmed cyberattack, and a precautionary shutdown does not mean that a website has been hacked.

What actually happened on 21 October 2026?

The PHP development team announced security releases to address two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 out of 10 (Critical) under the CVSS v4.0 severity system.

Under certain conditions, the flaws could allow remote code execution — in straightforward terms, an attacker could potentially run unauthorised code on a vulnerable server without first signing in. The issues are in PHP's underlying engine, not simply in a particular website theme, plugin or application.

On 20 October, the PHP team warned that an urgent release was coming. On 21 October, fixed versions were made available, while national cyber security authorities advised organisations to identify affected systems and update quickly.

Why were government and business websites taken offline?

The potential impact was serious enough that some organisations chose to temporarily suspend websites while they evaluated their exposure and waited for the patches. Reports on 21 October included precautionary action involving government services in countries such as the Netherlands, France and Finland.

This was not evidence of one single global hosting outage. In many cases it was a deliberate decision to reduce risk while security teams worked on a fix. The UK's National Cyber Security Centre (NCSC) also advised considering taking a vulnerable system offline if it could not be adequately updated or mitigated.

Organisations have been coordinating with their hosting providers, applying emergency patches, introducing temporary protective measures and watching for suspicious activity. Those are sensible responses to a critical security disclosure, especially for public-facing services.

Which websites and online systems could be affected?

PHP is a widely used server-side technology. It supports everything from small business websites to online shops, booking systems, customer portals and bespoke CRM applications. These vulnerabilities are not exclusive to WordPress or any single website platform.

• Business websites built using PHP or a PHP-powered content management system.
• Online shops processing customer enquiries, orders and payments.
• Bookings, memberships and customer portals that use PHP behind the scenes.
• Custom business software and CRM systems hosted on PHP servers.
• Third-party tools and appliances that bundle PHP within their own software.

A website that does not use PHP is not directly affected by these two PHP engine flaws. And even for websites using PHP, the exact exposure depends on the server environment and the protections and patches in place. It is therefore important to check the actual hosting configuration rather than assume every website is vulnerable — or safe.

Which PHP versions have been fixed?

The PHP project released the following security updates on 21 October 2026. These are the minimum fixed releases in their respective supported branches:

Running PHP 7.4, 8.0 or 8.1? These versions no longer receive regular security releases from the PHP project. Some managed hosting providers and long-term-support vendors can supply backported fixes, but you should confirm that protection explicitly and plan an upgrade to a supported version.

A managed platform might apply a vendor-backported fix without showing exactly one of the version numbers above. If your host manages PHP for you, ask which build or patch is installed rather than relying on the headline version alone.

What are hosting companies and businesses doing?

Hosting providers and IT teams have several responsibilities during an incident like this. Their work generally includes:

• Checking exposure: identifying public-facing servers and applications that run PHP.
• Rolling out patches: deploying vendor-approved PHP security updates as soon as possible.
• Adding temporary protection: tightening web application firewall rules or other controls while patches are deployed.
• Reviewing logs: looking for unusual requests, errors or signs of attempted exploitation.
• Testing essential functions: ensuring customer logins, orders, forms, integrations and emails still work after changes.
• Keeping customers informed: explaining any disruption, action required or confirmed change in exposure.

What I have done at MW Web & Automation

I manage business websites and bespoke web systems, so I take announcements like this seriously — particularly when the affected technology powers customer-facing services and operational systems.

Since the alert, I have reviewed the published PHP and UK cyber security guidance, checked the information available from my hosting provider, and sent updates to clients explaining the issue and what it means for their websites.

For one of the managed hosting environments used for my projects, the provider has confirmed that it tested its platform against these particular vulnerabilities, did not find it vulnerable, introduced additional protections and is deploying patched PHP releases automatically. That is reassuring, but it does not replace checking individual applications and any websites hosted elsewhere.

My ongoing security review

I am continuing to work through the practical checks that matter for my clients:

• PHP versions and hosting: checking which systems rely on PHP and confirming patch coverage with providers.
• Website and application updates: applying required updates where I control the deployment, with compatibility in mind.
• Backups: making sure a reliable backup is available before potentially disruptive changes.
• Important business functions: checking forms, customer accounts, booking processes, checkout flows and integrations after relevant updates.
• Monitoring and communication: following new advisories and contacting clients directly if their site needs attention.

I will not mark a website as fully reviewed until its own environment and relevant functionality have been checked. The goal is to keep clients informed while making changes carefully, rather than rush an upgrade that causes avoidable disruption to the business.

What should UK business owners do now?

If your website is managed by a developer or hosting company, you do not necessarily need to make changes yourself. But it is worth asking a few direct questions:

If you manage your own hosting, prioritise internet-facing PHP applications and follow the NCSC's security guidance and your provider's patch instructions. Where you cannot patch or appropriately protect an exposed system, consider restricting access or temporarily taking it offline until it can be secured.

Does this mean my business website has been hacked?

No. Identifying a vulnerability means that a potential attack path exists; it does not prove somebody has exploited it. Likewise, a website being available online does not prove it is patched.

Confirming whether a specific site was affected — or compromised — requires looking at its actual software, hosting configuration and, where appropriate, security and access logs. If you notice unexplained changes, strange admin accounts, unusual redirects or unexpected transactions, tell your developer or host immediately.

Why this matters beyond this week's headlines

This incident is a reminder that website security is not just about installing an SSL certificate or choosing a strong password. A professional website depends on many pieces working together: PHP, hosting, application code, databases, software packages, third-party integrations and sensible access controls.

Security maintenance should be ongoing, not something that only happens when a major news story appears. Regular patching, verified backups, sensible permissions and monitoring can make a real difference when urgent vulnerabilities are disclosed.

That is why I offer ongoing website maintenance alongside website development and custom systems and automation. The aim is to make sure the systems your business relies on remain maintainable and supported as they grow.

Frequently asked questions

Is every website affected by the October 2026 PHP vulnerabilities?

No. The alert concerns systems that use PHP, and their actual exposure depends on configuration and patch status. Websites not using PHP are not directly affected by these two specific flaws.

Will updating PHP make my website go offline?

Not necessarily. Many managed hosts can roll out security fixes without visible downtime. However, major PHP version changes can sometimes expose compatibility problems, so important features should be tested.

Can I rely on my hosting provider to apply the fix?

Some providers manage server-level PHP patches automatically; others require you to select or install updates. Ask your provider what is covered on your particular plan and whether the corrected PHP build is already in place.

Are older PHP versions safe if my host offers extra protection?

A vendor-maintained backport may address a specific vulnerability, but an unsupported PHP version remains a long-term maintenance concern. Confirm what has been patched and plan a supported-version migration.

Official sources and further reading

• PHP project — 21 October 2026 security advisory and fixed releases
• PHP Foundation — explanation of the vulnerabilities and response
• UK National Cyber Security Centre — critical PHP security issue
• ENISA — European cyber security agencies' joint statement

Related website security advice

• Website maintenance and ongoing support
• A practical website maintenance checklist
• How much does website maintenance cost in the UK?
• Ask me about a website security review

Michael Wood
Web Developer & Automation — MW Web & Automation
hello@michaelwood.tech