Two critical security vulnerabilities have been discovered in PHP, the software behind millions of websites worldwide, prompting urgent security warnings from the UK Government and cybersecurity authorities across Europe.
PHP is one of the most widely used technologies on the internet, powering approximately 69% of websites where the server-side programming language is known, including many WordPress websites.
The threat is serious, and website owners should take immediate action to ensure their websites are protected.
What has happened?
On 21 October 2026, the PHP development team released emergency security updates to address two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.
These vulnerabilities could potentially allow attackers to execute malicious code on affected web servers without needing to log in.
The UK’s National Cyber Security Centre (NCSC) has issued an official warning urging organisations to apply security updates immediately or consider taking affected systems offline until they can be secured.
Read the official UK Government cybersecurity warning
Why is this so serious?
Cybercriminals use automated tools to scan the internet for websites running vulnerable software. Once a vulnerability becomes publicly known, attackers can begin looking for opportunities to exploit it.
A successful attack could allow hackers to compromise a website, access sensitive information or potentially gain control of parts of the hosting server.
This is not something website owners should leave until their next scheduled maintenance.
What if your website is running an older version of PHP?
Security patches have now been released for supported PHP versions. However, older versions, including PHP 5.6 and PHP 7.3, are no longer officially supported and do not receive these security updates.
Websites running these versions must be upgraded to a secure, supported version of PHP or temporarily taken offline.
Unfortunately, websites developed many years ago may not be compatible with modern PHP versions. Upgrading could cause certain features to stop working, or the website itself may require development work before it can function correctly.
This is a common challenge with older websites and is not specific to any particular hosting provider.
What is Smart IT doing to protect customers?
At Smart IT, we have been taking immediate action to protect our hosting infrastructure and customers.
98% of websites hosted by Smart IT have already received the necessary security updates.
The remaining 2% are primarily older websites running outdated versions of PHP. We are working directly with those customers to either upgrade their websites or temporarily take them offline until they can be made secure.
Where older websites require development work, our team can assist with making them compatible with modern PHP versions.
Our priority is to protect our customers’ websites, data and the wider hosting infrastructure.
What should you do if Smart IT doesn’t host your website?
We strongly encourage all businesses to contact their existing website hosting provider immediately and confirm that the necessary PHP security patches have been applied.
Don’t assume your website is protected simply because it is working normally. A website can appear to function perfectly while still running vulnerable software.
If your website uses an outdated PHP version, ask your hosting provider whether it needs upgrading and whether your website is compatible with the latest security updates.
Need advice? We’re here to help.
If your website is hosted elsewhere and you’re concerned about these vulnerabilities, our team is happy to offer advice.
We can help you understand whether your website may be affected and discuss the options available to keep it secure.
The risk is real, the vulnerabilities are critical, and action should not be delayed.
