PHP Security Alert October 2026: Is Your Website at Risk?

Website security has made headlines today following the discovery of two critical vulnerabilities in PHP, a programming language used behind the scenes on many websites.

For business owners, the immediate concern is straightforward: could my website be affected, and what needs to happen next?

Security fixes have now been released. The priority is for website managers and hosting providers to check affected systems and apply the appropriate updates.

What has happened?

The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have each received a severity rating of 9.2 out of 10, placing them in the critical category.

They can allow an attacker to run code on an affected server without needing a login. In practical terms, successful exploitation could put website files, functionality and information at risk. CERT-EU has urged organisations to patch affected systems immediately.

This is a problem in the underlying PHP software. A website can look normal to visitors and still need urgent attention.

Does this affect every website?

The PHP team’s warning covers PHP installations that handle website requests. That makes it a significant issue for businesses whose websites depend on this technology.

It does not mean every website on the internet has been compromised. Exposure to a vulnerability and a confirmed security breach are separate things.

The relevant checks depend on how a website is built, where it runs and whether its hosting provider has already applied the fixes. The PHP team has released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some providers supply equivalent security fixes through their own software packages.

Why might a website be temporarily unavailable?

Taking a website offline can be a protective decision.

CERT-EU advises organisations to consider isolating affected public-facing applications if they cannot apply and verify a fix immediately. A temporary closure can reduce exposure during the update process.

An unavailable website is not, by itself, proof that someone has accessed it or stolen information. Its owner or provider needs to establish what has happened before making that claim.

What should business owners do?

Contact the person or company responsible for your website and ask whether it uses PHP, whether it is affected and whether the required security fixes have been applied.

For affected systems, the response should include checking the server software, applying the appropriate update and testing the website afterwards. Enquiry forms, bookings, payments and other business functions deserve attention during those checks.

Updating a website’s content or installing a plugin is not a substitute for fixing the underlying PHP installation. The PHP team states that an update is the complete solution; temporary measures do not make an affected installation safe.

If there are signs of unauthorised activity, the response needs to include an investigation into what may have been accessed or changed.

How Get Online Now supports your website

At Get Online Now, security is part of the ongoing care of the websites we build and manage. Our managed website platform includes security protections and platform maintenance, with relevant issues handled through the appropriate technical support channels.

For other websites we help monitor and support, we have already taken action in response to this alert, checking the relevant arrangements and following up where attention is needed.

Where monitoring identifies a problem, we receive an alert and investigate. If your website is affected, we take the relevant steps within our access and support arrangements, working with your hosting provider or other technical contacts when required.

You will receive a clear explanation of the issue, a plan of action and the best available timetable for resolving it. If that timetable depends on a provider’s update or further investigation, we will explain this and keep you informed as the situation develops.

Our commitment is to take security seriously, respond to identified problems and give you practical support without leaving you to interpret technical warnings alone.

Concerned about your website? Contact Get Online Now at hello@getonlinenow.co.uk to discuss the next steps.