A major security warning has been issued following the discovery of two critical vulnerabilities in PHP, the technology that powers millions of websites, including those built using WordPress.
The UK’s National Cyber Security Centre (NCSC), working with British cybersecurity company Netcraft, is helping to notify organisations that may be operating vulnerable systems.
The warning highlights a potentially serious threat to businesses relying on their websites for enquiries, bookings, online sales and everyday operations.
With emergency security updates scheduled for release on Wednesday 21 October 2026, website owners and hosting providers are being encouraged to take prompt action.
What Has Happened?
Two critical security vulnerabilities have been identified in PHP, the programming language used by WordPress and many other popular website platforms.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have each received a critical severity rating of 9.2 out of 10.
Both have been reported as potentially allowing something known as Remote Code Execution (RCE).
In simple terms, this means that criminals could potentially exploit vulnerable software to run malicious commands on a website server without needing legitimate access.
Depending on the circumstances, successful attacks could result in:
- Unauthorised access to websites and hosting environments.
- Theft or exposure of sensitive business and customer information.
- Websites being altered, damaged or taken offline.
- Installation of malicious software or ransomware.
- Further attacks against other websites and systems.
Although the precise level of exposure will vary between systems, the seriousness of the vulnerabilities has prompted an unusually urgent response from the PHP development team and cybersecurity organisations.
Why Are the NCSC and Netcraft Contacting Businesses?
The National Cyber Security Centre is part of GCHQ and is responsible for helping improve the UK’s cybersecurity.
Working alongside Netcraft, an established British cybersecurity company, the NCSC operates a Proactive Notifications Service.
This service uses publicly available technical information to identify websites and servers that may be running vulnerable software.
Where potential security issues are identified, the organisations responsible can receive notifications explaining the risk and recommending appropriate action.
Importantly, receiving one of these warnings does not necessarily mean a website has been hacked.
It means that a potential vulnerability has been identified and should be investigated.
For many small businesses, charities and organisations without dedicated IT departments, these notifications can provide valuable early warnings about security problems they might otherwise be unaware of.
What Does This Mean for WordPress Websites?
WordPress is one of the world’s most widely used website platforms, and PHP is a fundamental part of how it operates.
This means the latest security warning is relevant to WordPress website owners, even if their themes, plugins and WordPress installations are fully updated.
Unlike a vulnerability affecting an individual plugin, this issue concerns the underlying PHP software running on the web server.
Simply logging into WordPress and clicking the update button may not resolve the problem.
The necessary security updates may need to be installed through the website’s hosting environment or by the company responsible for managing the server.
This is particularly important for businesses using older hosting configurations or outdated PHP versions.
What Should Website Owners Do?
The PHP development team has scheduled emergency security updates for 21 October 2026 at 3:00 pm UK time.
Website owners and those responsible for managing their hosting should take the following precautions:
- Check your PHP version. Establish which version of PHP your website and hosting environment are using.
- Contact your hosting provider. Ask whether your server is affected and when the relevant security updates will be installed.
- Apply official security updates promptly. Ensure the appropriate patched PHP release is installed once it becomes available.
- Review older websites. Websites running unsupported PHP versions may require additional work or migration to a supported environment.
- Maintain reliable backups. Ensure secure, recent and restorable backups are available.
- Monitor website security. Check for unusual activity, unexpected changes and signs of unauthorised access.
For systems where immediate protection cannot be applied, additional precautions, including temporarily restricting public access, may be necessary.
Another Reminder That Website Security Cannot Be Taken for Granted
This latest security warning comes at a time when website security is becoming an increasingly important issue for businesses of all sizes.
Recently, concerns surrounding the Updraft security incident demonstrated how vulnerabilities involving trusted website services could potentially expose WordPress installations to attack.
Now, the PHP warning highlights another layer of website security that business owners may not even realise they need to consider.
It is easy to assume that a website is secure simply because it looks normal, loads quickly and continues to receive enquiries.
Unfortunately, that is not always the case.
A website can appear to function perfectly while running outdated or potentially vulnerable software behind the scenes.
At Square Cactus, we believe that ongoing website maintenance, security awareness, reliable hosting and professional technical support are essential parts of looking after a business website.
Need Help With WordPress or Your Website? Talk to Square Cactus
Whether you’re concerned about the latest PHP security vulnerabilities, have received a warning about your website or simply aren’t sure when your WordPress installation was last properly maintained, it may be time to seek advice.
At Square Cactus, we help businesses and organisations with WordPress website support, hosting, maintenance and ongoing website management.
We understand that most business owners want to concentrate on running their businesses, rather than worrying about software updates, server configurations and technical security issues.
Whether you need assistance with an existing WordPress website, want to discuss an ongoing support arrangement or are considering replacing an ageing website with something completely new, we’d be happy to have a conversation.
Concerned about your website? Let’s talk.
Visit www.squarecactus.co.uk to get in touch.
Further information
For further technical information and the latest official updates, visit:
