22 Oct Critical security vulnerability affecting websites
The National Cyber Security Centre (NCSC) has issued an urgent security alert concerning two critical vulnerabilities affecting PHP, the software used behind many websites and online services.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could under certain conditions allow an attacker to execute malicious code remotely without authentication.
PHP has now released security updates addressing the vulnerabilities and is strongly encouraging users to update immediately.
The currently fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are no longer receiving updates directly from the PHP project, although organisations using vendor-supplied PHP packages should check with their relevant vendor or hosting provider.
What retailers should do now
If somebody else manages your website: Contact your website developer, IT provider, e-commerce provider, or hosting company as soon as possible and ask them to confirm:
- whether your website or associated systems use PHP;
- whether they are affected by CVE-2026-109618 or CVE-2026-109619;
- whether the appropriate security update has been applied; and
- whether any further action is required from you.
If you manage your own website or server: The NCSC advises organisations to identify systems running PHP, prioritising internet-facing systems, and update to a version containing the security fix. It also recommends monitoring updates from third-party software suppliers, as PHP can be incorporated into other products and services.
Where a secure update cannot yet be applied, temporary mitigations have been published by the PHP team. If neither the update nor the temporary mitigations can be applied promptly, the NCSC advises organisations to consider taking the affected system offline until it can be fully mitigated. If a system cannot immediately be updated or disabled, it should also be assessed for evidence of compromise.
Please don’t assume that your website is unaffected simply because you do not manage PHP yourself.
For most retailers, the simplest and safest action is to forward this alert to whoever manages or hosts your website and ask them to confirm that the necessary action has been taken.
Official information
National Cyber Security Centre: Critical security issue affecting PHP – NCSC security alert
PHP: Security advisory – Critical remote code execution vulnerabilities – PHP security information
Given the potential seriousness of the vulnerability, we recommend that members do not delay in seeking confirmation from their website or IT provider.