PHP Security on your Website

You may have seen this in the news recently, but if you haven’t, keep on reading…

For more than a decade, security flaws have gone undetected on much of the internet. AI brought this to light, triggering a global cybersecurity alert. Cybersecurity agencies rushed to contain the fallout, urging website users to check whether their sites were affected and if so, to update the issue.

PHP stands for Hypertext Preprocessor, an open-source, back-end programming language which runs on a web server. In other words, when you visit a site, PHP code collects data and turns it into a page you can read.

Some researchers and organisations disclosed two vulnerabilities within PHP releases over the decade. The technical bugs, identified as CVE-2026-109618 and CVE-2026-109619, were ranked 9.2 out of 10 in severity by researchers. The flaw has been said to affect millions and millions of websites.

The alert happened on 21st October 2026 and disrupted tonnes of services globally. Some sites were even taken offline in other countries. However, many of the sites were back up and running by the next day. 

Some experts warned that the issue could leave poorly maintained websites, especially those belonging to smaller businesses with limited security resources, at greater risk.

The PHP Foundation rolled out patches to fix the vulnerabilities that had been lurking in their software for years. Afterwards, the foundation encouraged all users to update immediately. Tech companies also sought quickly to secure all their PHP systems.

This issue affects the back ends of websites and web development processes that are invisible to many users. Meaning most people won't need to take any action themselves. 

Reach out to your web host or developer to ensure server-level PHP security patches have been applied. Updating WordPress core or its plugins will not fix PHP-level vulnerabilities. If you manage your own website, I recommend checking whether these fixes are in place.

If you have any questions, feel free to reach out.