While Webnetism's own website and core platforms are not built on PHP, some applications hosted on our infrastructure may utilise PHP as part of their technology stack. For customers running PHP-based websites or applications, now is the time to review and update those systems.
Any third party systems that we control have already been patched.
What has been discovered?
The PHP Team has released security updates addressing two critical vulnerabilities:
- CVE-2026-109618
- CVE-2026-109619
According to the NCSC, these vulnerabilities relate to how PHP handles memory under certain conditions. In some scenarios, an attacker may be able to trigger memory corruption that could ultimately lead to unauthenticated remote code execution on a vulnerable server.
In practical terms, this means an attacker could potentially execute commands on an affected server without first needing valid credentials.
Which PHP versions should you update to?
The fixes were released on 21 October 2026 and are available in the following supported PHP versions:
- PHP 8.5 → Update to 8.5.12 or later
- PHP 8.4 → Update to 8.4.27 or later
- PHP 8.3 → Update to 8.3.36 or later
- PHP 8.2 → Update to 8.2.35 or later
If you're still running PHP 8.1 or earlier, there is currently no official security fix available, as these versions have reached end-of-life. The recommended course of action is to upgrade to a supported PHP branch as soon as possible.
It's also worth noting that some Linux distributions and hosting providers backport security fixes into their own packages. As a result, the package version reported by the operating system may not exactly match the upstream PHP version, even though the vulnerability has been addressed. Always consult your operating system vendor or hosting provider's security advisory if you're unsure.
Why this is significant?
PHP remains one of the most widely deployed technologies on the web and underpins countless business applications, content management systems and e-commerce platforms. As a result, vulnerabilities affecting PHP can have a broad impact across many sectors.
Potential consequences could include:
- Unauthorised access to hosted applications
- Website defacement
- Data theft
- Malware installation
- Service disruption
- Further compromise of connected systems
Importantly, organisations may be running PHP without realising it. Many third-party applications, appliances and software products include PHP as an embedded component.
Who should be concerned?
The NCSC advises organisations to identify systems running PHP across their environments and not to assume that only older installations are affected. Internet-facing systems should be prioritised for review and remediation.
This is particularly relevant if you operate:
- WordPress websites
- Laravel applications
- Magento stores
- Bespoke PHP applications
- Legacy business systems
- Third-party software known to depend on PHP
Recommended Actions
The guidance from the NCSC is straightforward:
Update PHP
Apply the latest available PHP security updates as soon as possible. Organisations running unsupported releases should prioritise migration to currently supported versions.
Isolate or Disable Vulnerable Systems
If security updates or temporary mitigations cannot be applied promptly, consider taking affected systems offline until they can be secured, particularly where they are publicly accessible.
Review Third-Party Applications
Many products bundle PHP internally. Check vendor advisories and ensure any available security updates are applied promptly.
Assess Exposure
Identify which systems are internet-facing and determine whether they are running vulnerable PHP versions.
Investigate Potential Compromise
If a vulnerable system has been publicly accessible, consider reviewing logs and security events for signs of suspicious activity before and after patching.
A Message for Webnetism Customers
If you host applications with Webnetism, it's important to review whether any of those applications rely on PHP. While the underlying hosting platform may be secure, application-level vulnerabilities must still be addressed within the software itself.
Keeping applications, frameworks and supporting components updated to supported versions is an essential part of maintaining a secure environment and remains the responsibility of the application owner.
For managed customers, we're always happy to discuss best practice approaches to vulnerability management and platform security. For self-managed environments, we strongly recommend reviewing your applications and prioritising any necessary security updates or upgrades.
Final Thoughts
Events like this are a useful reminder that cybersecurity isn't just about infrastructure. Vulnerabilities often arise within the applications organisations depend on every day.
Although Webnetism does not use PHP within its own website and core services, we encourage any customers, partners or organisations running PHP-based applications to review the latest guidance from the National Cyber Security Centre and apply the recommended updates without delay.
Further Reading: Critical security issue affecting PHP by the National Cyber Security Centre.
Get in touch