The UK's National Cyber Security Centre (NCSC) has advised organisations using PHP to take immediate action to identify affected systems and apply the latest security updates.
With PHP widely used across websites and web applications globally, here's what website owners need to know, what to check and what steps to take.
What Happened with the PHP Security Vulnerabilities?
On 21st October 2026, the NCSC published an alert concerning two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.
PHP is a programming language used by millions of websites, including those built with popular content management systems such as WordPress. It handles important behind-the-scenes functionality, including processing information, interacting with databases and generating website content. Over 70% of websites and online systems globally use PHP.
The vulnerabilities involve memory-handling issues which, under certain conditions, could allow attackers to execute commands on vulnerable servers without requiring the necessary authentication. Security fixes have now been released, but organisations need to ensure their systems have been updated appropriately.
Importantly, the NCSC advises organisations using any version of PHP to assess their systems and update to the latest patched version. This means the issue should not be dismissed simply because a website is running a relatively recent version.
For the latest technical details, read the NCSC's official PHP security alert.
What Should Website Owners Do Right Now?
If your website or applications use PHP, there are several steps that must be taken as soon as possible.
1. Check Which PHP Version Your Website Uses
Start by identifying whether your website runs PHP and which version is installed. Depending on your hosting provider, this information may be available through your hosting control panel or server configuration. If you're unsure, contact your website developer, hosting provider or technical team.
It's important to check all PHP installations, including those used by other applications or services connected to your website.
2. Check for and Apply Security Updates
The NCSC recommends updating to the latest fixed version of PHP. Before making changes, ensure appropriate backups are available and consider whether the update could affect your website's functionality.
PHP updates can sometimes introduce compatibility issues with older plugins, themes or custom functionality, so testing may be necessary. A competent web developer can action this for you. Once updates have been applied, check that your website is working as expected.
3. Review Plugins and Third-Party Applications
PHP isn't always limited to the main website installation. Some plugins, third-party applications, server tools and other software products may include or depend on PHP. Review any relevant software and check for security updates or guidance from its provider.
The NCSC also recommends monitoring third-party vendors for further updates, as additional fixes may become available.
4. Check for Signs of Suspicious Activity
If your systems may have been exposed, it's important to consider whether there is any evidence of compromise.
Potential warning signs include:
- Unexpected changes to website files or content.
- Unfamiliar administrator accounts or changes to permissions.
- Unusual server activity or unexplained spikes in resource usage.
- Unexpected redirects or suspicious website behaviour.
- Unrecognised scripts, files or scheduled tasks.
These signs do not automatically mean a website has been compromised, and an affected system may show no obvious signs.
The NCSC advises organisations that cannot immediately update or disable affected systems to assess them for evidence of compromise. If you suspect a security incident, seek assistance from a qualified cybersecurity professional before making changes that could remove important evidence.
5. Consider Temporary Security Measures if Updates Aren't Possible
Not every website can be updated immediately, particularly where older applications or custom functionality are involved. If an update cannot be applied straight away, the PHP security advisory outlines temporary mitigations that may help reduce exposure.
Where neither the security update nor suitable mitigations can be implemented promptly, the NCSC advises organisations to consider taking affected systems offline until they can be secured. This should be assessed carefully, balancing the security risk against the impact of downtime.
Why Have Some Websites Been Taken Offline?
Following the discovery of the vulnerabilities, government websites across several European countries were reportedly taken offline as a precaution. Importantly, taking a website offline does not necessarily mean it has been hacked. Temporarily restricting access can be a preventative measure whilst technical teams assess affected systems, apply security updates, and investigate potential risks.
For website owners, the priority should be ensuring the affected systems are secure before restoring normal operations.
Taking Your Website Offline? Consider the SEO Implications
If your website needs to be temporarily unavailable whilst security updates are carried out, there is another important consideration: how that downtime is communicated to search engines.
Google recommends using a 503 (Service Unavailable) HTTP status code when a website must be temporarily taken offline for a short period. This tells search engines that the website is temporarily unavailable, rather than indicating that its pages have permanently disappeared.
Understanding the difference between HTTP status codes is important:
- 503 (Service Unavailable): Signals temporary downtime, such as essential maintenance.
- 404 (Not Found): Indicates that a page cannot be found. Using this incorrectly during maintenance could affect how search engines index the page.
- 200 (OK): Signals that a request was successful. Returning this for a generic error or maintenance page can give search engines misleading information.
Where appropriate, a 503 response should include a Retry-After header to indicate when the website may become available again. For short periods of downtime, this approach can help reduce the risk of search engines treating existing pages as permanently unavailable. However, it is not a guarantee against SEO disruption. Extended downtime can still affect search visibility.
If possible, limit disruption to the affected functionality rather than taking the entire website offline. Security should always take priority, and any decision to keep parts of a website accessible should be based on a proper assessment of the risk.
For further technical guidance, see Google Search Central's recommendations for temporarily disabling a website.
What Should You Keep an Eye on Over the Coming Days?
Even after the immediate security updates have been applied, it's worth continuing to monitor your website and any further security announcements.
In particular, keep an eye on:
- Further PHP security releases: Check official PHP announcements for any additional fixes or updated guidance.
- Third-party software updates: Monitor plugins, applications and services that may depend on PHP.
- Website functionality: Check that forms, checkout processes, integrations and other important features continue to work correctly after updates.
- Server activity: Review relevant logs and security alerts for unusual behaviour.
- Website availability: Monitor for unexpected downtime, errors or performance issues.
If your website was temporarily taken offline, it's also worth checking Google Search Console once normal service has resumed to identify any crawling or indexing issues.
Where Can You Find Reliable Updates?
As the situation develops, it's important to rely on official security guidance rather than unverified information.
Useful resources include:
- National Cyber Security Centre (NCSC) – UK guidance on the current PHP vulnerabilities and recommended actions.
- PHP Official Website – PHP security releases, supported versions and technical updates.
- Google Search Central – Guidance on managing temporary website downtime and search visibility.
What Happens Next?
Security patches are now available for the newer affected PHP versions (version 8.2 and newer), but organisations should continue monitoring official guidance as the situation develops.
For website owners, the immediate priority is to check whether their systems are affected, ensure the relevant updates have been applied, and watch for any unusual activity. It's also worth keeping an eye on further announcements from PHP, the NCSC, and third-party software providers, as additional guidance may be issued.
If you're unsure whether your website is affected, contact your hosting provider or website developer to confirm what action, if any, is required.
A Note to our Clients
We’re aware of the latest PHP security Vulnerability and are keeping a close eye on developments and updates. We’re reviewing the relevant guidance and taking appropriate action where and when required to help keep the websites we manage secure.
For clients on our website maintenance plans, monitoring security updates and responding to potential vulnerabilities are a part of the ongoing support we provide.
If you have any questions or concerns about your website, please don’t hesitate to get in touch.