Critical PHP Security Vulnerabilities in 2026

If your website, application or other business software uses PHP, there is an important security update you need to be aware of.

Two critical vulnerabilities have been discovered in PHP that could allow an attacker to remotely execute malicious code on an affected web server without needing to log in first.

The UK's National Cyber Security Centre (NCSC) has advised organisations to take immediate action to address the vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619.

The NCSC has described this as a critical security issue and is encouraging UK organisations to take immediate action.  

Security updates have now been released, so organisations should identify systems running PHP and update them as a priority.  

So, who could be affected and what should your business do?

Does your WordPress website use PHP?

If your website is built using WordPress, this issue is particularly relevant.

WordPress relies on PHP to run, so your website could be affected even if PHP isn't something you normally manage or think about.

If you have administrator access to your WordPress website, you can check which version of PHP your website is currently using.

How to check your PHP version in WordPress

1. Log in to your WordPress Dashboard as an administrator.

2. Go to Tools > Site Health.

3. Select the Info tab.

4. Open the Server section.

5. Look for PHP version.

If your PHP installation needs updating, the change will normally need to be made through your hosting account or hosting provider, rather than directly within WordPress.

Before changing PHP versions, it's important to make sure your website is backed up and check the compatibility of your WordPress installation, theme and plugins.

If you're unsure how your WordPress website is hosted or don't feel comfortable making these changes yourself, speak to DNS before making any changes.

What has happened?

Two critical security vulnerabilities have been identified:

CVE-2026-109618
CVE-2026-109619

Together, the vulnerabilities have been referred to as PHP2Shell.

Both vulnerabilities can potentially allow what's known as remote code execution, or RCE.

In simple terms, an attacker could potentially make a vulnerable server run malicious code without first needing valid login details.

The NCSC is encouraging organisations to identify affected systems and take action to address the vulnerabilities.

Who could be affected by the PHP security vulnerabilities?

If your organisation has a website, web application or other software that uses PHP, you should establish whether it is affected.

This is particularly important for systems that are accessible from the internet.

It's also worth remembering that PHP isn't always obvious. PHP can form part of other software and applications in the background, meaning your organisation may rely on PHP without necessarily realising it.

This isn't therefore just something for businesses directly managing a PHP website to consider. It's important to check other software and applications your organisation relies on too.

Which PHP versions include the security fix?

Security fixes have been released in the following PHP versions:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

If you're running an older version of PHP, you should check the requirements and compatibility of your website or application and follow the latest guidance from PHP, your hosting provider or software vendor.

The NCSC recommends updating to the latest version of PHP and continuing to monitor for future updates.

What if you can't update PHP straight away?

Don't simply ignore the issue if you're unable to update straight away.

Temporary mitigations are available for organisations that cannot immediately apply the security update.

If you're unable to update or apply the recommended temporary mitigations, the NCSC advises considering taking the affected system offline until it can be fully secured.

What should you do about the PHP security vulnerabilities?

The priority is to identify, check and update.

Businesses should:

• Identify websites, applications and other systems that use PHP.

• Check which version of PHP they're currently running.

• Apply the relevant security updates as soon as possible.

• Prioritise systems that are accessible from the internet.

• Check for updates from software vendors if you use applications that may rely on PHP.

• Seek advice if you're unsure whether your systems are affected.

You can also read the latest guidance from the National Cyber Security Centre.

What can DNS do to help?

We appreciate that not every business will know whether its website, applications or other systems use PHP, let alone which version they're currently running.

If you're unsure whether you're affected or what action you need to take, DNS is here to help.

Our team can help you understand what you need to check and guide you on the appropriate next steps.

Contact our support team or call the DNS office and we'll help point you in the right direction.

What is PHP?

PHP, which stands for PHP: Hypertext Preprocessor, is a programming language commonly used to power websites and web applications.

It runs on web servers and works behind the scenes to help websites generate dynamic content and run different functions.

Most people using a website will never know that PHP is there, which is why businesses may be using it without necessarily realising it.

What does CVE mean?

CVE stands for Common Vulnerabilities and Exposures.

Think of a CVE number as a unique reference number given to a publicly disclosed cyber security vulnerability.

It allows cyber security teams, software developers and IT providers to make sure they're all referring to exactly the same vulnerability.

In this case, the two references businesses need to be aware of are:

CVE-2026-109618
CVE-2026-109619