October 22, 2026
Critical PHP Vulnerability: What Businesses Should Do to Protect Their Websites and Systems
If your organisation uses PHP across its websites, online portals, applications or other systems, there’s an important cyber security issue you need to be aware of.
The National Cyber Security Centre (NCSC) has issued guidance on two critical vulnerabilities affecting PHP, identified as CVE-2026-109618 and CVE-2026-109619, and is encouraging organisations to take immediate action.
The technical details are complex, but put simply, the issue can cause a problem with how PHP uses and manages memory. Under certain circumstances, an attacker could exploit this vulnerability. A security fix has now been released.
The important next step is to identify any systems using PHP and make sure the appropriate security update has been applied. The NCSC recommends identifying PHP across your infrastructure, prioritising internet-facing systems, and updating to the latest fixed version.
For many SMEs, however, there’s an immediate complication: you might not know whether your organisation uses PHP.
That’s particularly common when your websites, applications, hosting or other systems are managed by an external provider.
So, what do you need to know and what should you do next?
What is PHP and why does this vulnerability matter?
PHP is a programming language widely used for web development. It runs on web servers and is also used as a component within other products.
You don’t need to understand all the technical details behind PHP to respond appropriately. What matters is establishing whether any of the systems your organisation relies on could be affected and making sure the right action is taken.
This isn’t simply a technical issue. It’s an information security risk that needs to be identified, assessed and appropriately addressed.
How do I know if my organisation is affected?
The NCSC advises organisations to identify systems running PHP across their infrastructure and prioritise internet-facing systems. Importantly, its advice is not to limit checks to older versions of PHP.
Depending on how your technology is managed, you may need support from your:
- internal IT team
- web developer or marketing agency
- hosting provider
- managed IT service provider
- software suppliers
If you don’t know whether your website runs PHP, ask rather than assume it doesn’t.
A useful question to send to your provider is:
“Can you confirm whether any of our websites, web applications or other systems are affected by the recently reported critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and whether the necessary security updates or mitigations have been applied?”
This gives your provider something specific to investigate and, importantly, asks them to confirm what action they’ve taken.
What should you do about the PHP vulnerability?
Whether you manage your technology internally or rely on external providers, there are several practical actions to consider.
Identify systems using PHP
Start by establishing which systems across your organisation use PHP.
Prioritise systems that are accessible from the internet, but don’t limit your checks to your main company website. PHP may also be used in other products your organisation relies on.
Update affected systemsd
The NCSC recommends updating to the latest version of PHP and continuing to monitor for future security updates.
If you rely on third-party software, check the relevant vendor guidance and updates too.
Speak to your technology providers
If another organisation manages your technology, contact them and ask whether your systems have been assessed.
Don’t automatically assume an external provider has already dealt with the issue. Ask them to confirm whether your systems are affected and what action has been taken.
Consider temporary measures if you can’t update
If you’re unable to update immediately, temporary mitigations are available. If these can’t be applied, the NCSC advises organisations to consider taking the affected system offline until it can be fully mitigated.
Your IT team or provider should assess the appropriate course of action for the systems concerned.
Check for evidence of compromise
If you can’t update or disable an affected system immediately, the NCSC recommends assessing it for evidence of compromise before carrying out the upgrade or mitigation.
Installing an update addresses the vulnerability, but your organisation should still consider whether a previously vulnerable system may already have been compromised.
Our systems are managed by somebody else. Do we still need to do something?
Yes.
Many SMEs rely on third-party providers to manage their websites, hosting, applications or wider IT infrastructure. Even when somebody else looks after these systems, it’s still important to make sure any security risks affecting your organisation have been assessed and addressed.
Contact the organisation responsible for your systems and ask them to confirm:
- whether they’ve assessed your systems for the vulnerability
- whether any of your systems are affected
- whether the required security updates have been applied
- whether any temporary measures are needed
- whether there’s any indication that an affected system may have been compromised
Keep a record of their response and any action taken.
There’s a wider information security lesson here too: your organisation should understand who is responsible for managing its systems and how security vulnerabilities will be dealt with, particularly where you rely on third-party suppliers.
What action has ISO QSL taken?
We’ve also been taking precautionary action across our own systems in response to the vulnerability.
Following the temporary outage of our Client Portal, the necessary security update has now been completed, and the portal is back up and running.
We’re also completing the necessary updates to our online training portal. While this work takes place, you may experience some temporary disruption when accessing these services.
We appreciate your patience while these important security updates are completed and apologise for any inconvenience caused.
How could ISO 27001 support in situations like this?
Incidents like this are a useful reminder that good information security isn’t just about responding to individual threats as they arise.
Having an established approach to information security can help you understand what needs protecting, identify potential risks and determine how those risks should be managed.
This is where ISO 27001 Information Security, Cybersecurity and Privacy Protection can support your organisation.
ISO 27001 is an internationally recognised standard for Information Security Management Systems (ISMS). It provides a framework for managing information security and is designed around implementing, maintaining and continually improving an ISMS.
In practice, an established approach to information security can help you develop a clearer understanding of:
- the systems, technology and information your organisation relies on
- the information security risks you need to consider
- who is responsible for managing those risks
- how vulnerabilities are identified, assessed and addressed
- how information security risks relating to suppliers are managed
So, when a vulnerability like this is identified, you’re better placed to understand where you could be affected, establish who needs to take action and manage your response.
If this vulnerability has highlighted gaps in how you manage information security, it could be a useful opportunity to review your current approach and consider whether ISO 27001 could provide a helpful framework for your organisation.
What should you do next?
The key message is simple: don’t assume somebody else has taken action.
Identify whether your organisation has systems using PHP and make sure the appropriate security updates have been applied.
If your systems are managed externally, speak to the relevant provider and ask them to confirm that they’ve assessed your systems and taken any necessary action.
For the latest technical advice, refer directly to the National Cyber Security Centre and the relevant PHP or software vendor guidance. The NCSC is specifically encouraging organisations to identify PHP installations across their infrastructure and update to the latest fixed version.
And if this incident has raised broader questions about how your organisation identifies systems, manages information security risks or works with external suppliers, take the opportunity to review those arrangements.