A serious security flaw could affect your website
Two serious flaws have been found in PHP, the software behind many websites and online systems. Criminals are already using them. Here is what it means for your organisation, in plain English, and what to do next.
What has happened
- PHP is behind-the-scenes software that runs a large share of the world's websites, online shops, booking systems and client portals. Most people never see it, but it is there.
- On 21st October 2026, two serious security holes were found and fixed in PHP.
- Using these holes, a criminal can run their own commands on the computer that hosts your website, without needing a password.
- That could let them steal information, change your website, or use your systems to attack others.
Could this affect you?
- Your website is built on WordPress, WooCommerce, Joomla or Magento. These all run on PHP.
- You have an online shop, client portal, booking system or intranet that runs through a web browser.
- A web agency, hosting company or IT supplier looks after your website for you. They still need to apply the fix.
- Even a well-built website is at risk, because the problem is in PHP itself, not in your website.
What to do now
Three simple steps
- Find out who looks after your website and online systems. This might be your IT team, a web agency, your hosting company or a software supplier.
- Contact them today and ask the questions on this page. A fix has been available since 21st October, so they should be able to answer quickly.
- Ask for confirmation in writing. If you do not get a clear answer within a day or two, get help.
Questions to ask
- Do any of our websites or systems use PHP?
- Have they been updated with the security fixes PHP released on 21st October 2026?
- Have you checked whether anyone got in before the fix was applied?
- Can you confirm in writing once everything has been updated?
Why the update alone may not be enough
Criminals started using these flaws before the fix was released. Updating closes the hole, but it does not remove anyone who may have got in beforehand. That is why it is worth checking for signs of a break-in as well as applying the update.
Not sure where to start? We can help
Our team can take this off your hands with one-off support, charged by the hour. No technical knowledge needed on your side.
Check your risk
We find out whether your websites and systems use PHP, whether they are up to date, and whether there are any signs of a break-in. You get a clear, jargon-free summary.
Fix it for you
We apply the updates, make sure everything still works, and deal with your website or IT suppliers on your behalf.
For your IT team
The flaws are known as CVE-2026-109618 and CVE-2026-109619. Our technical advisory covers affected versions, fixes and remediation steps in detail.