Two Critical PHP Flaws Put Websites at Risk. Ask Your Host Today

The PHP project released a security fix on 21 October for two critical flaws, and the UK's National Cyber Security Centre has told organisations to act now. PHP is the language a huge number of websites run on, WordPress included, so this reaches well beyond developers.

The NCSC alert names the two flaws as CVE-2026-109618 and CVE-2026-109619. It says they may allow attackers to run commands on any web server running PHP, and that in some cases this could happen without logging in. It also says organisations using any version of PHP are affected, and that those on older versions are strongly advised to move to a fully supported release.

WordPress published its own notice the same day. It points out that the flaws are not specific to WordPress, and that no WordPress update is required or planned. The fix is in PHP, which sits on the server rather than inside your site. That is why updating WordPress will not help here.

What this means depends on who looks after your hosting. If you pay a host to run your website, the notice says your host may already be updating PHP and adding extra protection, but that you should still check with them and update if needed. A short message asking whether they have applied the October 21 PHP security update is a fair thing to send today. If you manage your own server, WordPress says PHP versions before 8.2 no longer get security updates from the PHP project, and quotes the NCSC's advice to consider taking the system offline until it can be fully mitigated if you cannot update straight away.

To see which PHP version a WordPress site runs on, open Tools, then Site Health, then Info, then Server in the dashboard. Many hosting control panels show it too. Neither the NCSC nor WordPress has said any particular site has been attacked, and this page does not either. The point is that the fix exists and the sensible time to apply it is now.

Who owns updates like this is the question a small business tends not to have answered. Our guide on keeping a small business website secure covers what to check and who should be watching. If you would rather hand that job over, get in touch and we will talk through what looking after a site involves, with care plans from £69 a month.

The full guide: Is My Website Secure? What to Check