PHP emergency updates: what business website owners should check

This story is developing and details may change. Last checked 23 Oct 2026.

What happened

Reported by Critical security issue affecting PHP | National Cyber Security Centre on 21 Oct 2026. The event itself dates from 21 Oct 2026.

PHP published emergency security releases on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619. The vulnerabilities can allow unauthenticated remote code execution. The NCSC has advised organisations to identify PHP installations and apply fixed releases. PHP also published a follow-up advisory on 23 October about session upload progress. That follow-up concerns an unusual combination of application code and configuration, so the current advisory matters alongside the original update. 1 2

Why it matters to small businesses

A business website may depend on server software managed by a hosting provider or another supplier. The PHP advisory covers installations handling web requests, with the highest risk identified for mod_php. For an owner, the useful next step is to establish whether PHP is involved and who is responsible for applying the relevant update. A website continuing to load does not answer that question. 1 2

TabSphere's view

This section is TabSphere's interpretation, not reported fact.

Our view is that clear responsibility makes maintenance easier. Keep a simple record of the provider managing your website, who handles server updates and where to find their advice. For this incident, technical decisions should follow the current PHP and NCSC guidance and the advice of the provider responsible for your installation.

What to do next

• Identify the responsible provider. Contact the person or company managing your website and ask whether it uses PHP and who handles PHP updates.
• Confirm the relevant update. Ask the responsible provider to check the current PHP advisory and confirm that the appropriate fixed release or vendor update has been applied.
• Check the follow-up advisory. Ask the provider to review the PHP follow-up published on 23 October. Its session upload progress advice depends on application code and configuration.
• Follow vendor guidance if updating is blocked. Use the current vendor and NCSC advice when an update cannot be applied. The NCSC says to consider taking a system offline if neither an update nor the relevant mitigation can be applied.
• Keep a record of the response. Record who checked the installation, what they confirmed and whether any follow-up work remains. Keep monitoring the official advisories for changes.

Sensible precautions

• Have the responsible provider assess configuration changes before applying them. The follow-up advisory describes specific conditions and does not mean every installation has the same exposure.

What isn't known yet

• This evidence does not establish whether any particular business website has been exploited.
• The follow-up advisory depends on application behaviour and configuration; a provider must assess the specific installation.

A clear answer from the provider responsible for your website is a useful outcome. Keep the official advice to hand and make routine maintenance responsibilities easy to find.

If you would like to discuss the design or development of your website, you are welcome to contact TabSphere.

Sources

Checked 23 Oct 2026.

• Critical security issue affecting PHP | National Cyber Security Centre (published 21 Oct 2026)
• PHP: News Archive, 2026 (security advisory and release information) (published 21 Oct 2026)
• Critical PHP Security Release, WordPress News (published 21 Oct 2026)
• PHP warns it plans to release 2 emergency patches imminently, Ars Technica
• NCSC-NL/php2shell: Operational information regarding the 2026 php2shell vulnerabilities (GitHub) (published 21 Oct 2026)