On 21 October, the National Cyber Security Centre (NCSC) warned of a critical security issue in PHP, one of the most widely used web scripting languages.

What has happened

The NCSC has issued an urgent advisory about two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. If exploited, they could allow attackers to run commands remotely on affected web servers.

The NCSC recommends immediate action. That includes taking affected systems offline where they cannot be adequately protected. You can read the full advisory on the NCSC website.

What we recommend you do

Many organisations will be affected by this issue. If you aren’t already managing it, we suggest four steps.

  1. Find where PHP is running. Start with internet-facing systems. PHP is often bundled within third-party products and appliances, so check with your software suppliers too.
  2. Update to the latest version of PHP. The PHP website has details on the security update, plus temporary mitigations if you can’t update straight away.
  3. Take systems offline if you can’t protect them. If you can’t update or apply the mitigations quickly, consider taking the affected system offline until you can, as the NCSC advises.
  4. Scan to confirm you’re protected. Once you’ve updated, run a vulnerability scan. If you don’t have access to vulnerability scanning, our recommended partner is Qualys.

The NCSC advisory also explains how to check for signs of compromise on systems that could not be patched immediately.

The wider lesson

“The recent PHP vulnerabilities highlight why organisations need to understand and actively maintain the technology underpinning their services. It’s not enough to implement a system and assume it will remain secure indefinitely. Businesses need clear technology roadmaps, supported infrastructure and the ability to respond quickly when critical vulnerabilities emerge.

 

Regular vulnerability assessments and penetration testing help organisations identify and address weaknesses proactively, while frameworks such as ISO 27001 provide the structure for managing security risks over time.

 

Business continuity is equally important. If a critical system needs to be taken offline, organisations need plans to maintain essential services and communicate effectively with customers.

 

Ultimately, technology risk is business risk. Boards need to understand their reliance on technology and ensure that maintaining, securing and modernising it remains an ongoing priority.”

 

Adam Seamons, Head of Security, Risk and Compliance, GRC Solutions

Need support?

Whether you’re concerned about this vulnerability or want to strengthen your security more broadly, our team is here to help. Call us on +44 (0)333 800 7000 or email [email protected].