Two critical security flaws in PHP, the software that runs a large share of the world’s websites, leaked online on 20 October before a fix was available. PHP is releasing emergency updates today, 21 October, at 14:00 UTC (15:00 UK time). This post explains what has happened, whether you could be affected, and what to do about it.
What happened
On the morning of 20 October, details of two serious PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) appeared online before the fixes were ready. Security researchers at watchTowr confirmed the flaws are real, and the PHP security team rated both critical, at 9.2 out of 10 (Huntress).
In plain terms, the flaws are described as “remote code execution” bugs. That means an attacker could potentially send a request to a vulnerable website and make the server run commands of their choosing. Researchers have nicknamed the issue “php2shell” for that reason.
The UK’s National Cyber Security Centre (NCSC) has issued an alert urging UK organisations to prepare to update PHP immediately. Where that isn’t possible, it advises considering taking the affected system offline until it can be fixed (NCSC).
The good news so far: as of its latest update, Huntress had not seen these flaws being exploited in the wild. No public attack code is known to exist yet, but researchers expect that to change quickly once fixes are published.
Could you be affected?
If your organisation runs a website or web-based system, there is a good chance PHP is involved somewhere. You may be affected if you use:
- A website built on WordPress, Drupal, Joomla or Magento
- Shared web hosting, or a hosting control panel such as cPanel or Plesk
- Business software or network appliances with a web interface, which often include PHP without advertising it
PHP has not yet confirmed exactly which versions are affected. Early reports suggest every version from PHP 5 onwards may be vulnerable, and PHP says the full list will be published with today’s release (PHP).
The biggest concern is older software. Fixes are expected only for versions PHP still supports, which would leave older, end-of-life versions with no patch at all.
| PHP version | Support status | Expected to receive a fix |
|---|---|---|
| 8.2, 8.3, 8.4, 8.5 | Supported | Yes |
| 8.1 and older (including 7.x and 5.x) | End of life | No |
Supported branches as listed by PHP and reported by Vincent Schmalbach; final details depend on PHP’s official release.
What you should do
Updating PHP itself sits with whoever hosts or built the system, usually your hosting provider, web developer or software vendor, rather than with your IT support. So the most useful thing you can do today is make sure the right people are on it:
- Check with your web developer or hosting provider if they manage your website, and ask whether they are applying today’s PHP update.
- Make a quick list of anything with a web page attached. That includes websites built or hosted by a third party, online shops, booking systems, and any office equipment or software with a web login page, then work out who looks after each one.
- Be ready for brief downtime. If an older system cannot be updated straight away, the NCSC advises taking it offline until it can be fixed (NCSC).
- Report anything unusual, such as unexpected changes to your website, new admin accounts, or warnings from your hosting provider.
If you’re a Snap IT client and you’re not sure whether something applies to you, just ask. We’ll happily help you work out where PHP might be in play and who you need to chase.
Questions?
This is a fast-moving situation and we will update this post once PHP publishes full details. If you have any concerns, or think you may run a system that uses PHP, please contact our team on 01603 980260 or hello@snap-it.co.uk.
