By now, you’ve probably seen the news about a critical security vulnerability in PHP, the software that runs behind the scenes of an estimated 70% of websites. The National Cyber Security Centre (NCSC) urged UK organisations to take immediate action, and for good reason: the flaw could allow an attacker to take control of a web server without needing a password.
Here’s what happened, what we did about it, and what it means for your business.
What is the PHP vulnerability?
On 21st October 2026, the PHP security team released updates fixing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Both were rated 9.2 out of 10 for severity. In certain conditions, they could allow an attacker to run their own code on a web server remotely, without logging in. Every version of PHP was affected, including older versions that are no longer officially supported.
What we did
When the PHP security team gave advance notice on 20th October that a critical fix was on its way, we cleared our diaries. By the time the patch was released just after 2PM the following day, our team was ready to go.
- Our customers’ Linux servers were patched the same evening.
- All of the 400+ websites we host are now protected, with patches thoroughly tested first to make sure nothing broke.
Our customers didn’t need to do a thing, and many heard from us before they had a chance to ask.
Why patching matters
Once a security fix is published, attackers study it too. They can work out exactly what the weakness was and start looking for systems that haven’t been updated yet. The window between a patch being released and criminals trying to exploit it can be hours, not weeks.
Patching isn’t glamorous, but it’s one of the most effective things any business can do to stay secure. It’s one of the five core controls in Cyber Essentials, the UK government-backed scheme, which requires critical security updates to be applied within 14 days. As a Cyber Essentials Plus certified business ourselves, we aim to move much faster than that when the risk is this serious.
What should you do?
If you have a website, it’s worth checking:
- Has your web host applied the PHP update? If you’re not sure, ask them directly.
- Is your website running an older version of PHP? Older versions no longer receive official updates, so it’s worth planning an upgrade. Always test your website thoroughly afterwards, as older plugins and themes may not be compatible.
- Are WordPress, plugins and themes kept up to date? Outdated plugins are one of the most common ways websites are compromised.
Need a hand?
If you’re not sure whether your website, servers or devices are being kept up to date, we’d be happy to take a look. Get in touch with the Wight Computers team for a no-obligation chat.
