Critical PHP Security Vulnerability: Why Your Website Needs to Be Updated Now

If you own a website, now is a good time to check that your hosting environment is up to date. On 21 October 2026, the PHP development team released urgent security updates addressing two critical vulnerabilities that could put websites and web servers at risk.

PHP is the technology that powers many websites, including WordPress sites, online shops and other web applications. If your website runs an affected version of PHP, failing to apply the relevant security patch could leave it exposed to serious security risks.

At New Forest Online, we take website security seriously. As soon as the relevant updates became available, we took action to update our own server environment. Here’s what website owners need to know and what you should do to protect your website.

What is the latest PHP vulnerability?

Two critical vulnerabilities have been identified in PHP:

• CVE-2026-109618
• CVE-2026-109619

Both vulnerabilities have been rated critical, with a CVSS severity score of 9.2 out of 10. Under certain conditions, an attacker could exploit an affected PHP installation to execute malicious code remotely without needing to authenticate first.

This could potentially allow an attacker to compromise a server, access sensitive information or interfere with the operation of a website. The actual impact depends on the hosting configuration and the application involved.

These are not simply routine software updates. They address security weaknesses that website owners and hosting providers should take seriously.

Which PHP versions are affected?

The PHP security updates released on 21 October 2026 address the vulnerabilities in the following supported release branches.

PHP 8.1 and older branches are no longer supported by the main PHP project and do not receive official upstream security fixes. Some hosting providers and operating system vendors may provide backported patches, so owners of older installations should ask their provider to confirm their security status and plan an upgrade to a supported version. PHP 8.2.35 is patched for this vulnerability, but PHP8.2 reaches end of life on 31 December 2026.Where compatibility permits, planning a move to a newer supported branch is sensible.

Importantly, simply running a particular PHP version number does not always tell the whole story. Some hosting providers apply security fixes through their own software packages. Your hosting provider should be able to confirm whether the relevant patch has been applied.

You can read the official announcement on the PHP security news archive.

What could happen if you don’t update?

Leaving vulnerable software running on a publicly accessible website can create opportunities for attackers. Depending on the circumstances, a successful attack could result in:

• Website compromise: An attacker could potentially execute malicious code on the affected server.
• Data exposure: Information accessible to the compromised application or server could be at risk.
• Malware or malicious changes: Attackers may attempt to modify website files, introduce malicious content or use a compromised server for further attacks.
• Business disruption: Recovering from an incident could involve downtime, technical investigation and restoration work.
• Reputational damage: A compromised website can undermine customer confidence, particularly if visitors are exposed to suspicious content or their information is affected.

These are potential consequences, not a statement that every vulnerable website will be compromised. However, given the severity of these vulnerabilities, it is important not to assume that your website is safe simply because it appears to be working normally.

What should you do to protect your website?

If your website is hosted by a third-party provider, we recommend taking the following steps.

1. Contact your hosting provider

Raise a support request and ask them to confirm which PHP version your website is using, whether it is affected by CVE-2026-109618 and CVE-2026-109619, and whether the appropriate security patch has been applied.

2. Ensure your website uses a supported PHP version

Where possible, use a supported PHP release with the relevant security updates installed. Any upgrade should also be checked for compatibility with your website’s content management system, themes, plugins and other software.

3. Check the wider website environment

Keeping PHP updated is an important part of website security, but it is not the only consideration. Your website’s content management system, plugins, themes, server configuration and backups should also be maintained.

4. Investigate any signs of compromise

Applying a patch helps address the vulnerability, but it does not establish whether an attacker accessed the website before the update. If you suspect your site may have been compromised, ask your hosting provider or a qualified security professional to investigate.

How we handled the PHP security update

At New Forest Online, we believe website security should be part of the ongoing service we provide, not something considered only when a problem arises.

Following the release of the PHP security updates on 21 October 2026, we updated the PHP versions on our own servers within a couple of hours as part of our response to the advisory.

We took this action to ensure our environment was updated with the relevant security fixes. We also recognise the importance of keeping software maintained beyond the initial launch of a website.

Our approach is to take security advisories seriously, apply relevant updates promptly, and consider the compatibility and stability of the websites we build and maintain.

The benefits of having a website designer who takes security seriously

Choosing a website designer should be about more than appearance, functionality and the initial launch. Your website also needs ongoing care to help keep it secure, reliable and compatible with evolving technologies.

When you work with New Forest Online, we can help you with:

• Security-conscious website development: We consider security and software compatibility when building your website.
• Up-to-date hosting environments: Where hosting is managed by us, we can apply relevant server-side security updates and monitor important software developments.
• Ongoing maintenance: We can help keep your website’s underlying software, plugins and themes maintained, according to the service agreed with you.
• Practical advice: If a security issue affects your website, we can explain what it means and help you identify the appropriate next steps.
• A long-term partnership: Rather than leaving you to navigate every technical issue alone, we can provide ongoing support within the scope of your maintenance and hosting arrangements.

Of course, no website can be guaranteed to be completely immune to cyberattacks. Security depends on several factors, including hosting configuration, software maintenance, access controls and monitoring. Our aim is to reduce avoidable risks and help our clients make informed decisions about their websites.

If your website is hosted elsewhere, you should still contact your current hosting provider about this vulnerability. You do not need to redesign your website to request a security update.

Is it time to review your website?

This latest PHP vulnerability is a useful reminder that websites need ongoing attention after they go live.

If you are unsure which PHP version your website is running, whether your hosting provider has applied the relevant patches, or whether your website would benefit from a wider technical review, we would be happy to discuss your options.

And if you are considering a new website, we can help you build a modern, professionally designed site with security, maintainability and ongoing support in mind.

Get in touch with us today to discuss your website, hosting and maintenance requirements.

Stay informed. Keep your website maintained. Don’t leave security updates until it’s too late.

Further information

• Official PHP security announcements
• NHS England Digital: Critical PHP vulnerability advisory