The PHP security flaw: what your business needs to do this week

This week a critical security flaw in PHP, the software behind most of the web, has had organisations around the world taking websites offline. A government minister told the House of Lords that 32 UK government services were unavailable while fixes went in. If you run a small business, here’s what it means and what to do this week.

What PHP is, and why this matters

PHP is a programming language that runs on web servers. You’ll rarely see its name, but it powers WordPress and most of the other systems small businesses use for their websites. The two flaws fixed on 21 October 2026, known as CVE-2026-109618 and CVE-2026-109619, could let an attacker take control of a web server without a password. Whoever controls the server can change your website, use it to spread malware, or take any data stored on it, such as enquiries sent through your contact form.

Details leaked before the fix was ready, and attackers started trying to use them straight away. The National Cyber Security Centre (NCSC) says it has no indication of any successful breaches in the UK so far, but it’s urging every organisation that uses PHP to act now.

Your checklist for this week

1. Find out what your website runs on, and who hosts it. If it’s WordPress on a hosting account, it runs PHP. If it’s on Wix, Squarespace or Shopify, the platform handles this for you.
2. Get written confirmation that the fix is in. Email your host or web developer and ask them to confirm PHP has been updated. Updating WordPress and its plugins isn’t enough, because the fix has to go into PHP itself. AlphaSec, part of the Alphabyte Group, has a step-by-step guide with an email you can copy.
3. If they can’t confirm it, take the site offline. That’s the NCSC’s advice, not over-caution. A holding page for a day costs far less than a hacked website.
4. Look beyond the website. PHP also runs inside other systems, including some webmail, client portals and booking systems, and the admin pages of some firewalls, phone systems and storage devices. Anything that can be reached from the internet needs checking with its supplier.
5. Tighten up website logins once the fix is in. Change the admin passwords for your website and hosting account, remove old accounts, and turn on two-step verification wherever it’s offered.
6. Watch out for scam emails. Big security stories are often followed by fake emails that use them, such as an “urgent PHP update” message asking you to log in or pay. If you get one, go to your host’s website directly rather than clicking the link.

Cyber Essentials and insurance

If you hold Cyber Essentials, its rules say updates for critical vulnerabilities must be installed within 14 days of release on the systems in scope. For this flaw, that means by 4 November 2026. Your cyber insurer may also ask what you did and when, so keep your host’s written confirmation.

How we can help

If we look after your IT and you’re not sure whether anything you use runs PHP, call the helpdesk on 02920 022100 and we’ll go through it with you. If you’re not a client, AlphaSec’s free security snapshot looks at your website from the outside and tells you what to ask your host.

And if this is the push you needed to replace an old WordPress site, AlphaPixel, also part of the Alphabyte Group, builds fast websites with no PHP, database or plugins to patch, so a flaw like this one doesn’t touch them. Here’s how that works.