Critical PHP Security Flaw: What the NCSC Alert Means for Small Business Websites

The NCSC has warned that two PHP flaws (CVE-2026-109618 and CVE-2026-109619) could let attackers run commands on web servers, and urges organisations to update to the fixed PHP versions 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

By Entrepreneur Group · Published 28 October 2026

Critical PHP Security Flaw: What the NCSC Alert Means for Small Business Websites

The National Cyber Security Centre (NCSC) has warned UK organisations about a critical security issue in PHP, the programming language behind many websites, online shops and content management systems. Two flaws, CVE-2026-109618 and CVE-2026-109619, published on 21 October 2026, could allow attackers to run commands on web servers, in some conditions without logging in. The fix is to update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

Many small businesses run PHP without knowing it, through a hosted website, a shop platform or a plugin. This guide explains what the NCSC says and the questions to ask your developer or host.

What the NCSC has said

According to the NCSC alert, the two flaws relate to how PHP handles memory during web requests:

CVE-2026-109618: if PHP runs out of memory while request data is only partly set up, the clean-up process can later treat that invalid data as valid.
CVE-2026-109619: internal state from one request can persist after its memory has been freed, so a later request on the same worker may use stale data.

The NCSC says that, together, these could allow attackers to run commands on web servers running PHP, in some conditions without authentication. It says organisations using any version of PHP are affected and that users of older versions should move to a fully supported release.

The PHP project's own security advisory rates the first issue as critical, with a CVSS v4 score of 9.2. It lists the affected versions as those before 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and those four releases as the patched versions. The advisory reports a working exploit that gave unauthenticated remote code execution against one common server set-up with default settings. It says updating is the only complete mitigation, and that changing memory or input limits reduces the risk but does not fully fix it.

The NCSC's recommended steps

The NCSC sets out a priority list for organisations:

1. Find all PHP installations, starting with internet-facing systems, whatever the version. 2. Update to the latest PHP version, internet-facing systems first, then internal ones. 3. If you cannot update yet, apply the temporary mitigations published by the PHP project. 4. If mitigations are not possible or would take too long, consider taking the system offline. 5. If a system cannot be updated or disabled straight away, check it for signs of compromise and backdoors, and get help from an NCSC-assured Cyber Incident Response provider if needed. 6. Watch for updates from third-party vendors whose products or appliances include PHP.

The Dutch NCSC has published an inventory of potentially affected software, which can help you check whether products you use include PHP.

What founders should do this week

This section is editorial guidance, not a substitute for professional security advice.

Find out whether you use PHP. Ask your web developer, agency or hosting provider. Many content management systems, e-commerce platforms and customer portals run on PHP.
Ask for the PHP version in writing. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Anything earlier on those branches needs updating, and older unsupported branches should be moved to a supported release.
Check managed hosting. If your host manages PHP for you, ask whether it has applied the update and when. Do not assume it has.
Look beyond your website. Booking systems, intranets and internal tools may also run PHP. List them and check each one.
Keep a record. Note what you checked, who confirmed it and when. This helps if your insurer or a customer asks about your response.
Use free NCSC services. The NCSC alert also points UK organisations to its free Early Warning service and its vulnerability management guidance.

Frequently asked questions

Which PHP versions fix the October 2026 vulnerability?

The PHP project lists 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as the patched versions. Earlier versions on those branches are affected, and the NCSC says users of older PHP versions should move to a fully supported release.

Is my small business website affected by the PHP flaw?

It may be if your website, shop or other web system runs on PHP. The NCSC says organisations using any version of PHP are affected, so ask your developer or host which version you run and whether it has been updated.

What should I do if I cannot update PHP straight away?

The NCSC advises applying the PHP project's temporary mitigations, or considering taking the system offline if that is not possible. It also recommends checking unpatched systems for signs of compromise.

Sources

NCSC: Critical security issue affecting PHP (21 October 2026) (reviewed 28 October 2026)
PHP project security advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618) (reviewed 28 October 2026)
NCSC-NL: inventory of potentially affected PHP software (reviewed 28 October 2026)