Critical PHP Vulnerability: What It Means for Your Business and What to Do Now

Emergency update, 22 October 2026. Details may change as more information is released.

The Short Version

• Two critical security flaws have been found in PHP, software that runs a huge number of websites and IT systems.
• If they’re left unpatched, an attacker could take control of a server without needing a username or password.
• Fixes were released on 21 October, and updating is the only complete fix.
• Outlaw’s own systems and our customers’ systems are being actively reviewed and updated.

What Has Happened

On 21 October, the PHP project released security updates for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. The UK’s National Cyber Security Centre (NCSC) has also issued a warning.

Both flaws come from how PHP handles memory while it processes requests from visitors. In plain terms, an attacker could trigger a memory error on the server, and under certain conditions turn it into the ability to run their own commands on that server. That’s known as remote code execution, and in this case it doesn’t need a login first.

At the time of writing, it’s unclear whether the vulnerabilities are being successfully exploited.

What’s Affected

• Any server that uses PHP to serve web pages. The NCSC says all PHP versions may be affected, including ones that aren’t out of date.
• Websites built on PHP platforms like WordPress, whether you host them yourself or someone else does.
• Products and services that bundle PHP, such as some appliances and hosted tools. Your supplier will need to release their own updates for these.

If you only use cloud services and don’t host anything yourself, you may not run PHP directly. It’s still worth asking your suppliers whether any of the products you rely on do.

What to Do Now

1. Find out where you use PHP. Start with anything reachable from the internet, such as your website, customer portals, and booking or ordering systems. If you’re not sure, ask whoever built or hosts your site.
2. Get it updated. Ask your host or developer to confirm they’ve applied the latest PHP security update. If you manage your own servers, update PHP now.
3. Check your suppliers. If a product you use includes PHP, watch for updates from the vendor and apply them promptly.
4. If you can’t update straight away, the PHP project has published temporary mitigations. These reduce the risk but don’t make a system safe. If mitigations aren’t possible or would take too long, the NCSC suggests considering taking the system offline until it’s fully fixed.
5. If you can’t update or take it offline, check the system for signs of compromise, such as unfamiliar files, new admin accounts or unexplained traffic.

Technical Details for IT Teams

• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Older versions: PHP 8.1 and earlier no longer get updates from the PHP project, so check with your long-term support vendor for backported packages.
• Affected setups: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project says the risk is highest for mod_php.
• End of life: PHP 8.2 reaches end of life on 31 December 2026, so it’s a good time to plan the move to a newer version.
• Advisories: GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619).

What Outlaw Is Doing

Outlaw’s own systems and our customers’ systems are being actively reviewed and updated. We’re identifying where PHP is in use, checking versions and applying updates. We’ll be contacting customers directly, where required, in due course.

Update, 23 October 2026, 16:47: Outlaw has identified all affected systems and contacted any affected clients. Where systems are managed by Outlaw directly, these have now been patched.

For further support or questions call 0115 6777 238 or email ayup@outlaw-it.co.uk. If you’re a customer, you can use the support portal to raise a ticket: Login : Outlaw IT Support Portal.

Sources: NCSC: Critical security issue affecting PHP and the PHP project security advisory, 21 October 2026.