Critical PHP vulnerabilities: What website owners need to know

Website security is back in the headlines following the discovery of two critical vulnerabilities affecting PHP, the technology that powers millions of websites worldwide, including WordPress.

On 21 October 2026, the PHP development team released emergency security updates to address two serious vulnerabilities that could potentially allow attackers to gain unauthorised access to web servers.

The UK’s National Cyber Security Centre (NCSC) has also issued guidance urging organisations to take immediate action.

While news like this can understandably cause concern, it’s another important reminder of why keeping your website and its underlying technology up to date is essential.

Here’s what you need to know, what the vulnerabilities mean for your website and how Platform81 is helping protect our clients.

What has happened with PHP?

PHP is a programming language used behind the scenes to power websites and web applications. It’s responsible for processing information, handling forms, communicating with databases and delivering dynamic website content.

Two critical security vulnerabilities have recently been identified within PHP itself:

• CVE-2026-109618: A vulnerability involving how PHP handles memory during certain requests.
• CVE-2026-109619: A vulnerability involving how PHP manages internal information following an error.

Both vulnerabilities have received a critical severity rating of 9.2 out of 10.

If successfully exploited, they could potentially allow an attacker to execute malicious code on a vulnerable web server without needing to log in.

Unlike vulnerabilities affecting individual WordPress plugins or themes, these issues exist within PHP itself. This means they can affect a wide range of websites, regardless of the content management system being used.

The vulnerabilities affect numerous PHP versions, including older versions that are no longer officially supported.

What does this mean for your website?

If your website runs on PHP, it’s important to establish which version is installed and whether the relevant security updates have been applied.

The vulnerabilities could potentially expose affected websites to serious security risks, including unauthorised access, disruption to website functionality and compromised information.

However, running an affected version of PHP doesn’t automatically mean your website has been hacked. It means there is a security weakness that needs to be addressed.

The PHP development team has now released security patches for supported versions, and hosting providers are working to make these updates available across their platforms.

For website owners, the priority is ensuring these patches are installed as soon as possible, with appropriate checks to confirm everything continues working correctly.

Why regular website maintenance matters

When people think about website maintenance, they often focus on updating WordPress, plugins or themes. However, keeping a website secure goes much further than that.

Behind every website is a combination of technologies, including PHP, web server software, databases and hosting infrastructure. Each plays an important role in keeping your website running securely and reliably.

This latest PHP security issue highlights why website maintenance shouldn’t be treated as a one-off task.

Security vulnerabilities can emerge unexpectedly, and when they do, responding quickly is essential.

What is Platform81 doing?

At Platform81, website security and ongoing maintenance are an important part of the support we provide to our clients.

Following the announcement of these critical PHP vulnerabilities, our development team has been reviewing the affected environments and taking the necessary steps to protect the websites we support.

This includes identifying affected PHP versions, monitoring the availability of security patches, applying updates where available and carrying out appropriate checks to ensure websites continue functioning as expected.

Where immediate updates aren’t available, we assess the available security measures and any additional precautions required until a permanent fix can be applied.

Our approach goes beyond simply installing an update. We consider the wider website environment and the potential impact on functionality, helping to minimise disruption while addressing security risks.

Already a Platform81 support client?

If you’re an existing Platform81 website support client, you can be reassured that we’re already taking action.

Our development team is aware of the PHP vulnerabilities and has taken the necessary steps to review and address the affected environments under our management.

As part of our ongoing support and maintenance services, we monitor security vulnerabilities, manage updates and take action when critical issues are identified.

Not sure whether your website is affected?

If Platform81 hosts or supports your website and you’re unsure whether these PHP vulnerabilities affect you, please don’t hesitate to get in touch with our team.

We’ve been proactively reviewing the websites and hosting environments under our management, taking the necessary steps to address these vulnerabilities and apply security updates where available.

If you have any concerns or would simply like reassurance about your website’s security, we’re more than happy to help.

Get in touch with our team if you have any questions.