Chris Grant (he/him) October 21, 2026 A 4 minute read

PHP October Security Update: How We Are Protecting Your Website

The National Cyber Security Centre (NCSC) has told UK organisations to act on a critical security issue in PHP. PHP is the language behind most WordPress websites, so this matters for your business.

Here is what has happened, what we have done for customers hosted with us, and what to check if your website sits with another host.

What has happened

The PHP project gave advance notice on 20 October 2026 of a security release. The fixes arrived on 21 October, the same day the NCSC published its alert. They cover two issues, CVE-2026-109618 and CVE-2026-109619, and PHP rates both 9.2 out of 10 for severity.

In plain English, an attacker could push a web server running PHP into running out of memory, or cause the server to reuse leftover data from an earlier request. Under certain conditions, the attacker then runs commands on the server without needing a login. PHP rates the risk highest on servers using mod_php, where a demonstrated attack runs before your website’s own code even starts.

The NCSC says all versions of PHP are affected. PHP’s fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The NCSC is continuing to monitor the impact on UK organisations.

What this means for your website

PHP runs on the web server behind your site. WordPress, Drupal and many plugins and themes depend on PHP to build your pages and talk to your database.

The weakness sits in PHP itself, not in your content or a single plugin. Updating your plugins does not replace updating PHP on the server. The fix happens at hosting level, and your hosting control panel normally shows which PHP version your site uses.

What we have done

We have followed the NCSC advice on our own servers:

  • We identified the systems running PHP, starting with internet-facing servers.
  • We updated PHP to the fixed release for each version we run.
  • We are watching for further PHP and vendor updates and will apply them as they arrive.

Where we manage your domain name, your website also gets firewall protection from Cloudflare. Cloudflare switched on default rules for this issue from 03:02 UTC on 21 October, ahead of the public release. The rules check both the request and the response for each visit, and block a harmful response before the visitor receives it. Cloudflare also reports attack traffic aimed at customers after details leaked before the release date.

Cloudflare itself advises customers to update PHP as well. A firewall adds a layer of protection but does not replace the server fix.

If we host your website, we handle the server update for you. If your site runs an older PHP version, get in touch so we check which steps apply.

If your website runs an older version of PHP

PHP 8.1 and older no longer receive updates from the PHP project. Some hosting providers and Linux vendors supply their own backported fixes, so ask yours whether they do. The safer route is a move to a supported version. PHP 8.2 receives its last security fixes on 31 December 2026, so a newer version is the better target.

A sensible order of work looks like this:

  • Take a backup of your website.
  • Check your plugins and themes work on the newer PHP version. Older ones often break between versions, so test on a copy of your site first.
  • Change the PHP version in your hosting control panel, or ask your host or developer to do it.

What to do if your website is hosted elsewhere

Ask your hosting provider or developer four questions:

  • Has PHP been updated to a fixed release?
  • Which PHP version does my website run?
  • If my site runs PHP 8.1 or older, do you provide a backported fix?
  • Do any other tools on the server bundle their own copy of PHP?

NCSC-NL, the Dutch national cyber security centre, has published an inventory of software products with a potentially affected PHP dependency. Your provider can check this list.

If your host cannot update straight away

PHP says only an update fully fixes these issues. Its temporary settings reduce exposure to specific attack routes but do not make a server safe. The NCSC sets out this order of action:

What not to do

  • Do not assume an older PHP version is the only risk. All versions are affected, and older ones get no fix from the PHP project.
  • Do not treat the temporary settings as a fix.
  • Do not rely on plugin updates alone.
  • Do not ignore the alert because your website looks normal.

When to get help

If you are unsure where your website is hosted, which PHP version runs behind your site, or whether your plugins work on a newer version, get in touch with the O’Brien Media team. We help you check the right information and decide whether any action is needed.

Call us on 01793 239239 or email [email protected].

This article is based on reporting by the National Cyber Security Centre, the PHP project, Cloudflare, and relevant official information.