A serious cyber security issue has recently been discovered in PHP, a technology that powers millions of websites and web applications worldwide.
Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been identified that could allow cyber criminals to take control of vulnerable web servers remotely, without needing a username or password. Both vulnerabilities have been given a critical severity rating of 9.2 out of 10.
As a result, the National Cyber Security Centre (NCSC) is urging organisations to act quickly, particularly if they have websites or applications that are accessible from the internet.
What is PHP?
PHP is one of the most widely used technologies for building and running websites. It works behind the scenes to power features such as:
- Website content and forms
- Customer portals
- Online booking systems
- Ecommerce platforms
- Database-driven applications
The challenge is that many businesses don’t realise they’re using PHP. It is often built into websites, hosting platforms and third-party applications, meaning you may be affected even if you’ve never heard of it.
Why does this matter?
In simple terms, these vulnerabilities could allow an attacker to gain unauthorised access to a vulnerable server and run malicious commands remotely.
Security researchers have already reported that proof-of-concept exploits are being shared publicly, increasing the likelihood of attackers attempting to exploit vulnerable systems.
If successful, an attack could potentially lead to:
- Website compromise
- Data theft
- Service disruption
- Malware installation
- Unauthorised access to connected systems
Who could be affected?
Any organisation using a website or web application running a vulnerable version of PHP could be at risk.
This includes common web hosting environments and server configurations used by businesses of all sizes.
Security updates have now been released to address the issue, so organisations should ensure affected systems are updated as soon as possible.
What should businesses do now?
The most important step is to find out whether your organisation uses PHP and whether the latest updates have been applied.
The NCSC recommends that organisations:
✅ Identify any systems running PHP, particularly those accessible from the internet.
✅ Update PHP to the latest secure version.
✅ Review third-party applications and platforms that may include PHP.
✅ Apply temporary security measures if updates cannot be installed immediately.
✅ Check for signs of compromise on any vulnerable systems.
For most businesses, this starts with a conversation with your website provider, hosting company or IT support partner. They should be able to confirm whether PHP is in use and whether the necessary security updates have been applied.
Cyber Security Doesn’t Stop at Microsoft 365
Security vulnerabilities like this are an important reminder that cyber security extends beyond laptops, email accounts and Microsoft 365.
Your website, web applications, cloud services and third-party platforms can all create potential entry points for attackers if they aren’t properly maintained.
Even organisations with strong endpoint and email security can still be exposed if internet-facing systems are left unpatched.
Regular updates, vulnerability management and a clear understanding of your technology estate are all essential parts of protecting your business from modern cyber threats.
Not Sure if You’re Affected?
If you’re unsure whether your website or applications use PHP, speak to your IT provider or web hosting company as soon as possible. A quick review can help identify any risks and ensure the appropriate security updates have been applied before attackers have the opportunity to exploit them.
Alternatively speak with our experts at Bluecube on 0330 002 1220
Posted in: Cyber Security, News.
Can we help?
Contact usIf you have enjoyed reading this article and want to know more about Bluecube, please get in touch. Our friendly team will be happy to answer any queries.
