Critical PHP Security Vulnerability: What Businesses Need to Know
PHP sits behind a huge number of websites and web applications, so although the name probably means very little to most people, this is an important security update that businesses should be aware of.
Two vulnerabilities have been identified, CVE-2026-109618 and CVE-2026-109619, both of which have been rated Critical with a score of 9.2 out of 10.
What is PHP?
Put simply, PHP is technology that runs behind many websites.
You generally won’t see it or interact with it directly. It sits on the web server and does a lot of the work behind the scenes.
That means you could potentially be using PHP without even knowing it.
What’s happened?
Researchers have discovered serious security weaknesses within PHP itself.
If a vulnerable server is exposed to the internet, an attacker may be able to exploit the issue without first needing a username or password. In the wrong circumstances this could allow them to run commands on the server.
There are also now public examples showing how the vulnerability can be exploited, and security companies have reported exploitation attempts in the wild.
That’s why this one needs to be taken seriously.
What should businesses do?
Don’t panic, but don’t ignore it either.
If you have a website or web application, particularly one hosted on your own server or VPS, you should establish whether it uses PHP and, if it does, make sure the underlying PHP installation has been updated.
The corrected PHP releases are:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
If you’re running PHP 8.1 or older, these versions are end of life and no longer receive normal security updates from the PHP project. Rather than simply applying an update, you should be looking at moving the website or application onto a currently supported PHP version.
“Someone else looks after our website”
That’s absolutely fine, and will be the case for many businesses.
Our advice is simply to contact your website developer or hosting company and ask:
Does our website or hosting environment use PHP, and if so, has it been updated to protect against CVE-2026-109618 and CVE-2026-109619?
They should be able to answer that for you.
One important point is not to assume that because a website is hosted by somebody else, everything has automatically been updated. Responsibility for PHP updates will depend on how the website and hosting service have been set up.
Does this affect normal Windows computers?
For most businesses, your normal Windows PCs and servers are unlikely to be affected simply because they run Windows.
PHP isn’t normally part of a standard Windows desktop or server installation. The concern is where PHP has been deliberately installed to run a website, web application or other web-based service.
So, for a typical office environment using Windows PCs, Microsoft 365 and standard business applications, this isn’t something users need to take action on themselves.
Where you do need to check is if your business:
- Hosts its own website or web application
- Runs a web server internally
- Uses a server or VPS where PHP has been installed
- Has bespoke or older web-based applications
- Has a website managed by a third-party developer or hosting company
If somebody else manages your website or hosting, our advice is simply to ask them:
Does our website or hosting environment use PHP, and if so, has it been updated to protect against the recently announced vulnerabilities?
Do I need to worry?
For most customers, no. But it does need checking in the right places.
This isn’t a vulnerability where we’d expect everyone in the business to start updating their Windows laptops or changing passwords.
It’s primarily an issue for systems specifically running PHP. If your website is fully managed by a hosting company or developer, they should be checking the underlying platform and applying any necessary updates.
As with most critical vulnerabilities, the important thing is not to panic. It’s to establish whether you’re affected, make sure the appropriate updates have been applied, and move on.
How Ashby Computers can help
Good cyber security isn’t about panicking every time a new vulnerability appears. It’s about knowing what you have, keeping it supported and making sure important security updates aren’t ignored.
Contact Ashby on 01604 790979 or enquiries@ashbycomputers.co.ukto discuss your business backup and recovery needs.
