The PHP Security Alert: Is Your Business Website Affected?

What Has Happened

On 21 October 2026 the NCSC published a critical security alert about two flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. PHP is the programming language running behind most websites. You never see it, but if your site has a contact form that works, a shop, a blog you log in to, or a content management system of any kind, there is a very good chance PHP is doing the work.

The short version: under the right conditions, an attacker can send specially crafted requests to a website running PHP and end up running their own commands on the server. No password, no login, no click from anyone on your side. The NCSC's own wording is that the flaw "may allow attackers to execute commands on any web server running PHP". The Dutch national cyber security centre is tracking affected products under the name "php2shell", which tells you how seriously they take it.

PHP's developers released fixed versions the same day: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Anything older than those is in scope. Anything on PHP 8.1, 8.0 or the 7.x series reached the end of its official support some time ago and will not get a fix at all unless your hosting provider patches it themselves.

Why This Matters to a Small Business in Sussex

Roughly seven in ten websites with a known server-side language run PHP (W3Techs, October 2026). WordPress alone powers about four in ten websites, and WordPress is PHP from top to bottom. So are WooCommerce, Joomla, Drupal, Magento, and nearly every "we built you a site" template a local agency has sold in the last fifteen years.

That means the typical Horsham plumber, Crawley builder or Brighton café website is almost certainly in scope. Not because anybody did anything wrong, but because the whole industry stands on the same foundation.

What an attacker does with a compromised small business website is rarely dramatic and nearly always expensive:

• Your site starts redirecting visitors to scam pages or pushing malware, and Google flags it as dangerous. Your search rankings fall off a cliff and can take months to recover.
• Your contact form submissions, customer details or shop orders are read by someone else. Under UK GDPR that is a reportable breach.
• The server is used to send spam or attack other sites. Your host suspends the account, and your email goes down with it if it is on the same package.
• A backdoor is left behind so that even after a "fix", they can come back whenever they like.

This is why the NCSC's advice goes as far as "consider taking the system offline" if it cannot be patched. For an agency that normally chooses its words very carefully, that is a strong line.

Does Your Website Run PHP? A Quick Way to Tell

You don't need to be technical. Run through these:

• Do you log in to edit your site at an address ending in /wp-admin? That is WordPress. It is PHP.
• Was it built on Joomla, Drupal, Magento, PrestaShop, OpenCart or Laravel? PHP.
• Is it on Wix, Squarespace, Shopify or GoDaddy Website Builder? These platforms patch their own servers. There is nothing for you to do, though it is worth a glance at their status page this week.
• Is it a static site (plain pages, no login, no admin area)? Then there is no PHP in the site itself. The hosting company still runs software underneath, and patching that is their job, but there is nothing inside the site for this flaw to reach. Every site we build is this kind, and there is more on that below.
• Not sure? Ask whoever built it, or whoever you pay for hosting. "What version of PHP is my site running, and has it been updated for CVE-2026-109618?" is a fair question and should get a straight answer within a working day.

What to Do Today

In the order the NCSC lists them, translated for a business owner rather than an IT department:

1. Find out what you have. The checklist above covers most cases. If you own more than one site or domain, do it for each.
2. Get PHP updated. Most hosting control panels (cPanel, Plesk, hPanel) let you pick the PHP version from a dropdown. It needs to be 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later. On the day of the alert, some large hosts had not yet rolled the fixed builds out, so the dropdown may not offer it yet. Check again each day until it does.
3. If you cannot update yet, ask for the temporary mitigations. The PHP Foundation published settings that reduce the exposure in the meantime. Roughly, they cap how large a request the site will accept and switch off upload progress tracking. We applied them on our own hosting within hours of the alert. A competent host or developer will know what they are.
4. Update WordPress, your theme and every plugin while you are there. Not because they fix this flaw (they don't), but because an out-of-date plugin is the usual way in regardless, and the attention you are paying today is worth using.
5. Take a backup now, before anything else changes, and keep it somewhere other than the hosting account itself.
6. Look for signs you have already been hit. Files changed in the last few days that nobody touched, admin users you don't recognise, your site looking different in Google's results than it does when you visit it, or your host emailing about "unusual activity". If anything looks wrong, don't start deleting things. Get help first, so whoever helps can see what happened.
7. If it cannot be patched and nobody can mitigate it, take it offline for now. A "back soon" page costs you a day or two of enquiries. A hacked site costs you a great deal more.

What to Ask Your Web Designer or Host

You don't need to understand the detail. You need a yes or no. Copy and paste this:

"Following the NCSC alert of 21 October about PHP (CVE-2026-109618 and CVE-2026-109619), can you confirm: (1) what version of PHP my site runs, (2) whether it has been updated to a fixed release or had the PHP Foundation mitigations applied, (3) when my last backup was taken, and (4) whether the site has been checked for signs of compromise?"

If they come back with a clear answer, good. If they are vague, or the person who built your site three years ago no longer replies at all, that is itself the answer: your site is unmaintained, and this will not be the last alert of its kind.

How Our Own Sites Fared, and Why

We will be straight about this, because we were doing exactly this exercise on the morning of 22 October.

Every website we build and host for clients is a static site: plain HTML, CSS and a little JavaScript. There is no PHP in them, no WordPress, no plugin stack, no admin login to brute-force. That is a deliberate choice we made years ago, partly for speed and partly for exactly this reason. The hosting company still runs software underneath, and that is theirs to patch, but there is nothing inside the site for this flaw to reach.

The morning after the alert we went through every customer site we host, file by file, confirmed none contains a PHP file or a content management system, and confirmed each one sits behind Cloudflare. We are letting every customer know, with the NCSC link and the result. The one small PHP script we did have on shared hosting (a sign-off form for a client project) was moved into our own systems the same day, and we applied the PHP Foundation mitigations to the hosting account anyway, because belt and braces costs nothing.

Nobody's site needed a repair. Nobody's site needed taking down. That is what "low maintenance" is supposed to mean.

An honest note: static sites are not for everyone. If you run a shop with hundreds of products, or a members' area, you need a database and the software that comes with it, and you need that software maintained. There are no bad choices here, only unmaintained ones. We cover the trade-offs in Wix, Squarespace or a professional designer and in our guide to what a website costs in the UK.

Kit at Home Can Be Affected Too

The alert is not only about websites. Plenty of products ship with PHP inside their own web interface: some NAS drives, home server apps such as Nextcloud, and the admin pages of some routers and camera recorders. The Dutch NCSC is keeping an inventory of affected products as vendors confirm them.

If a device in your home has a web page you log in to, check the manufacturer's site for a firmware update this week. If that admin page is reachable from the internet (port forwarding, or a "remote access" feature you switched on once and forgot), turn it off until the device is patched. Our guide to smart home security and privacy explains why we set every system up so that nothing needs to be exposed to the internet in the first place.