A critical security issue has been identified affecting PHP, a technology widely used behind the scenes by websites and web applications, including many websites built using WordPress.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could under certain conditions allow an attacker to remotely execute commands on an affected web server without authentication. The National Cyber Security Centre is advising organisations using PHP to take action and apply the relevant security updates.
What does this mean for your business?
You may use PHP without realising it. PHP runs behind many websites and web applications and may also be incorporated into third-party products and services.
We recommend that businesses take the following steps:
1. Contact your website developer or hosting provider
Ask whoever manages your website to confirm that it is running a supported and fully patched version of PHP and that the latest security updates have been applied.
2. Check third-party web portals and systems
If your organisation relies on third-party web applications, portals or other online systems, contact the relevant provider and ask them to confirm that their systems have been reviewed and any required PHP security updates have been applied.
This is particularly important because PHP can also be bundled within other products and services.
