It’s been announced today, 21st October 2026, that two critical security vulnerabilities have been discovered in PHP, the technology that powers millions of websites worldwide. If your business has a website, online shop or web application, it’s important to understand what this means and what action you should take.
The vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619, have both been given a severity rating of 9.2 out of 10, making them extremely serious.
The UK’s National Cyber Security Centre (NCSC) has issued an alert advising businesses to take immediate action.
What is PHP and what’s the problem?
PHP is a programming language that works behind the scenes to make websites function. It’s used by popular platforms including WordPress, WooCommerce, Magento and many bespoke business applications.
The newly discovered vulnerabilities could potentially allow hackers to access a vulnerable website or server without needing a username or password.
In simple terms, it’s like somebody finding a way into your business without needing a key.
What are the risks?
If exploited, these vulnerabilities could allow hackers to:
- Steal customer information or other sensitive business data
- Take control of your website, changing content or installing malicious software
- Disrupt your website, potentially resulting in downtime and lost sales
- Access connected systems, creating further security risks
Importantly, having a vulnerable website doesn’t mean you’ve been hacked, but it does mean action is needed to protect it.
What should your business do?
There are five important steps we’d recommend:
- Check your PHP version. Ask your developer or hosting provider whether your website uses PHP and if it’s affected by these vulnerabilities. All versions are affected, but there is a patch available which protects against this vulnerability.
- Apply the latest security updates. Ensure PHP is updated to a version containing the official security patches. Updating WordPress or Magento alone doesn’t necessarily update PHP.
- Check your website security. Make sure you have a properly configured firewall and that your website software, plugins and extensions are kept up to date.
- Check for suspicious activity. Your developer should review available security records for signs of unusual activity or unauthorised access.
- Check your backups. Make sure regular backups are taken, stored securely and can be restored if needed.
If your website cannot be updated immediately, speak to your developer about temporary protection. The NCSC advises that vulnerable systems may need to be taken offline until they can be secured.
How CDA can help
At CDA, we believe technology should help your business, not make life more complicated.
We host, support and maintain websites and business applications, including WordPress, WooCommerce, Magento and bespoke systems. If you’re concerned about these PHP vulnerabilities, we can check whether your website is affected, apply the necessary security updates and review your existing protection.
We also provide ongoing website maintenance, security monitoring, backups and support to help prevent issues before they become serious problems.
Not sure if your website is secure? Get in touch with CDA and we’ll help you understand what needs to be done.
