Back Todaysconveyancer

PHP security flaw hits property websites and technology | Today's Conveyancer

Todaysconveyancer • October 23, 2026

The Council for Licensed Conveyancers (CLC) has urged its regulated community, and others, to “take action” in the wake of an issue with the PHP programming language used by many websites and technology companies.

A critical cybersecurity flaw in the programming language has triggered widespread global internet disruption with thousands of websites being taken offline as a precautionary measure to deploy emergency security patches.

According to the National Cyber Security Centre PHP runs around 70% of the world’s websites; the secuirty issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption which under certain conditions could be epxloited to remote access websotes.

In the property market Rightmove, estate agency CRM providers Loop and Street, and Perfect Portal were amongst those reported to Today’s Conveyancer as being affected. Lloyds, Halifax, Royal Bank of Scotland, HSBC and Revolut are also said to have been affected

The CLC said practices should check whether their websites, servers or other products use PHP and ensure the security update has been applied. PHP have released a patch which fixes the issue.

More information is available on the NSCS website.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both vulnerabilities allow unauthenticated remote code execution (RCE) and have a CVSS score of 9.2. The attack vector involves the `session.upload_progress` feature in PHP, which can be manipulated to execute arbitrary code. Patches were released on October 21, 2026, but exploitation attempts continued shortly after the fixes were made public. The vulnerabilities affect multiple PHP versions, including those that are no longer supported. Organizations are urged to apply the patches immediately and review their systems for potential exposure. 27 sources 73

Extracted Entities

PHP security flaw hits property websites and technology | Today's Conveyancer

The full story

Extracted Entities

Attack Types (1)

Companies (8)

Industries (1)

Platforms (1)