Critical PHP Security Warning : Is Your Website Affected?

Those of you who joined us at last month's Cyber Chamber meeting will remember we talked the growing threat of online scams, phishing and how AI is making cybercrime increasingly sophisticated.

This week, the National Cyber Security Centre (NCSC) issued an urgent warning a serious security vulnerability affecting millions of websites. It's a reminder that protecting your business isn't just spotting suspicious emails or avoiding scams. It's also making sure the technology behind your website is secure.

PHP is a programming language that powers a huge number of websites, including many built using WordPress. Two critical security vulnerabilities have been discovered, known as CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell .

In certain circumstances, these flaws could allow hackers to run malicious commands on a website's server without needing a password or login.

The NCSC issued its warning on 21 October, confirming that all versions of PHP could be affected, not just older installations. Even a relatively new website could therefore be vulnerable. Emergency security updates have now been released, but having a fix available isn't the same as having it installed.

Check your website today via the following link

Why does this matter to your business?

If your website is compromised, the consequences can go far beyond a broken page or a few hours of downtime.

Criminals could potentially steal customer information, redirect visitors to fraudulent websites, distribute malware or use your legitimate website to carry out phishing attacks. And this brings us back to something we discussed at Cyber Chamber: trust .

Imagine a customer receiving a convincing email directing them to your genuine business website, only to find that criminals have compromised it. Your reputation could be used against the very people who trust you.

For a small business, the financial damage can be significant, but rebuilding customer confidence can be even harder.

What are security patches, and why are they important?

You may have heard the term patching when it comes to website security. A security patch is simply a software update designed to repair a weakness that hackers could exploit. Think of it as discovering that a lock on your business premises is faulty and replacing it before somebody takes advantage.

The problem is that many websites rely on several different pieces of software, all of which need maintaining. For example, updating WordPress or its plugins doesn't necessarily mean the underlying PHP software has been updated.

The latest emergency PHP patches address these newly discovered vulnerabilities, but they need to be applied by whoever manages your website's hosting or server. The longer a known vulnerability remains unpatched, the longer criminals have an opportunity to exploit it.

You don't need to be technically minded to take action, but there are a few important things every business owner should check.

Emergency patches are now available. The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 , and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.

Find out whether your website uses PHP. Websites built using WordPress, Drupal and several other platforms commonly rely on it. An online tool such as can give you a quick answer.

Find out whether your website uses PHP. Websites built using WordPress, Drupal and several other platforms commonly rely on it. An online tool such as can give you a quick answer.

Check that the emergency security patch has actually been installed. your hosting company or whoever maintains your website. Ask them to confirm that your PHP installation has been updated to a version containing the latest security fixes. Don't assume that automatic updates have already taken care of it.

Check that the emergency security patch has actually been installed. your hosting company or whoever maintains your website. Ask them to confirm that your PHP installation has been updated to a version containing the latest security fixes. Don't assume that automatic updates have already taken care of it.

Don't forget older websites. That old promotional website, microsite or forgotten online project could still be running vulnerable software. Make sure every website associated with your business is checked.

Don't forget older websites. That old promotional website, microsite or forgotten online project could still be running vulnerable software. Make sure every website associated with your business is checked.

Ask what happens if an immediate update isn't possible. Temporary security measures are available, but these are not a permanent solution. In some circumstances, the NCSC recommends temporarily taking affected systems offline until they can be secured.

Ask what happens if an immediate update isn't possible. Temporary security measures are available, but these are not a permanent solution. In some circumstances, the NCSC recommends temporarily taking affected systems offline until they can be secured.

Make website maintenance an ongoing priority. Security isn't something you address once and forget. Regular updates, monitoring and a clear understanding of who is responsible for them are essential.

Make website maintenance an ongoing priority. Security isn't something you address once and forget. Regular updates, monitoring and a clear understanding of who is responsible for them are essential.

You can read the official NCSC security warning here .

Want one less thing to worry ?

One thing I regularly come across when working with small businesses are websites running on hosting packages that nobody is actively maintaining. The website might look perfectly fine, but behind the scenes, software updates, security patches and maintenance may have been overlooked for months or even years. Often, the business owner doesn't even realise these responsibilities fall to them.

I build websites using Squarespace and am a Squarespace Platinum Partner . One of the advantages of the platform is that Squarespace manages the underlying hosting, infrastructure and platform security updates, removing much of the technical maintenance associated with traditional website hosting.

It doesn't eliminate every possible security risk, but it does mean you aren't personally responsible for keeping PHP, server software and countless website plugins updated. You also get a website that's straightforward to manage and update yourself.

If you're concerned your existing website, or simply want to explore whether Squarespace could be a better option for your business, I'd be happy to have a no-obligation chat.

Get in touch: [email protected]

Source: National Cyber Security Centre, "Critical security issue affecting PHP", 21 October 2026.