PHP security vulnerability: what UK and Irish businesses need to know

On 21 October 2026, two critical security flaws were found in PHP, the software that runs behind the scenes on most of the world’s websites....

Gina Brennan

Published Date: 22/10/2026

On 21 October 2026, two critical security flaws were found in PHP, the software that runs behind the scenes on most of the world’s websites. Fixes are already available, and cyber security agencies in the UK and Ireland are urging every business that uses PHP to update as a priority. For most businesses, the first step is simple: ask your website or hosting provider to confirm the update has been applied.

In this guide, we explain what PHP is, what the vulnerability means in everyday terms, how to tell whether your business could be affected, and exactly what to do next. If you’d rather talk it through, our local teams in Glasgow, Belfast and Dublin are here to help.

At a glance

What happened: Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”, were made public on 21 October 2026. Both are rated 9.2 out of 10 for severity.
The risk: On a server that hasn’t been updated, an attacker could run their own code without needing a password.
The fix: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.
Who’s affected: Any business, in any sector, with a website or online system that uses PHP and hasn’t been updated.
What to do: Ask your website or hosting provider to confirm your systems are running a fixed version of PHP.

What is PHP?

PHP is a programming language that runs on web servers and builds the pages you see on many websites. When someone visits your website, fills in a form or logs into a portal, PHP is often the software doing the work in the background. It fetches information from a database, puts the page together and sends it to the visitor’s browser.

You may never have heard of PHP, but there’s a good chance your business relies on it. It powers popular website platforms including WordPress, Drupal, Joomla and Magento, and web technology tracker W3Techs estimates it runs on roughly 75% of websites whose programming language can be identified.

A simple way to think about it: if your website is a shop, PHP is the staff working out the back. Customers never see them, but nothing works without them. That’s why a flaw in PHP can affect thousands of unrelated businesses at once.

What is the PHP security vulnerability?

The PHP security vulnerability is a pair of critical flaws, CVE-2026-109618 and CVE-2026-109619, that could let an attacker take control of a web server running an out-of-date version of PHP. Security researchers have nicknamed them “PHP2Shell”. Both are rated 9.2 out of 10 on the CVSS severity scale, which puts them in the critical category.

A “vulnerability” is simply a weakness in software that someone could take advantage of. In this case, the weaknesses are in the way PHP handles memory while it processes requests from website visitors. Under certain conditions, a specially crafted request could trick PHP into running the attacker’s own commands, and the attacker wouldn’t need a username or password to try.

Why does that matter for a business? If an attacker gains control of the server behind your website, they could potentially access files, customer data or connected databases, change your website, or use it to target others. The flaws were discovered by security researchers at Wiz and Calif using advanced AI tools, and the UK NCSC says organisations using any version of PHP are affected.

The PHP project released fixed versions on 21 October 2026. The PHP team says updating is the only complete solution.

PHP version branch	Fixed version	Notes
PHP 8.5	8.5.12	Supported
PHP 8.4	8.4.27	Supported
PHP 8.3	8.3.36	Supported
PHP 8.2	8.2.35	Supported until 31 December 2026
PHP 8.1 and older	No fix from the PHP project	Upgrade, or ask your provider about a vendor backport

Why were websites taken offline?

Websites were taken offline as a precaution, so organisations could apply the fix before attackers had a chance to use the flaws. A website going offline did not mean it had been hacked. In many cases, organisations chose to switch services off briefly rather than leave them exposed.

According to BBC News, affected or potentially affected services included Finnish government websites, City of Edinburgh Council’s website and pages linked to BBC programmes such as Doctor Who and The Traitors. In Ireland, Department of Justice websites were also reported offline for essential works. Across Europe, government portals, hospitals and public services in the Netherlands, Denmark, Germany, France and Belgium took similar steps.

Cyber security agencies moved quickly. The UK National Cyber Security Centre and the National Cyber Security Centre Ireland both issued advisories, alongside agencies in Europe, Australia and Japan. Cloudflare reported seeing early attack attempts on 21 October, which is why acting quickly matters.

Is my business affected by the PHP vulnerability?

Your business could be affected if any of your websites or online systems use PHP and haven’t yet been updated to a fixed version. This applies to every sector, from hospitality and retail to healthcare, education, professional services and manufacturing. Size doesn’t matter either: a small business website is just as exposed as a large corporate one.

PHP often sits inside systems you might not think of as a “website”. Places it’s commonly found include:

Your company website, especially if it’s built on WordPress, Drupal or Joomla
Online shops, including WooCommerce and Magento stores
Booking and appointment systems for restaurants, salons, clinics and hotels
Customer or client portals where people log in to view accounts, invoices or documents
Intranets and staff tools used inside your business
Website control panels used to manage hosting, email and domains
Business software and devices that have PHP built in by the supplier

How can I tell if my website uses PHP? The quickest way is to ask your website developer or hosting provider. As a rule of thumb, if your website runs on WordPress or another popular content management system, it almost certainly uses PHP.

Many small businesses use shared hosting, where the hosting company manages the server and the PHP software on it. In that case, applying the update is usually your hosting provider’s job, but it’s still worth confirming it’s been done rather than assuming.

Does updating WordPress fix the PHP vulnerability?

No. Updating WordPress, your theme or your plugins will not fix this issue, because the flaw is in PHP itself, not in WordPress. WordPress automatic updates won’t apply the fix either. The PHP update has to be installed on the web server by whoever manages it, usually your hosting provider.

Think of it like a house. WordPress is the furniture and decoration, and PHP is the foundations underneath. You can replace every piece of furniture, but it won’t fix a crack in the foundations. That job sits with whoever looks after the building.

This is one of the most common misunderstandings we expect to see, because many businesses rightly trust their WordPress site to keep itself up to date. If you run a WordPress site, contact your hosting provider directly and ask them to confirm the PHP update has been applied to your server.

What if my website runs an older version of PHP?

If your website runs PHP 8.1 or older, the PHP project has not released a fix for your version, so you’ll most likely need to upgrade to a supported version. These older versions are “end of life”, which means the PHP project no longer provides security updates for them. Some hosting and software vendors provide their own fixes for older versions, known as backports, so it’s worth asking your provider what’s available.

Older PHP versions are surprisingly common on small business websites that were built a few years ago and have been working fine ever since. Upgrading is usually straightforward, but on older or heavily customised sites it can occasionally affect how some features work, so your developer may want to test it first.

It’s also worth planning ahead. PHP 8.2 receives security updates only until 31 December 2026, so if you’re upgrading now, moving to PHP 8.3 or later will save you doing it again in a few months.

What should businesses do now?

The most important thing to do now is confirm that every system your business uses has been updated to a fixed version of PHP. You don’t need to be technical to do this. Follow these steps:

Make a list of your online systems. Include your website, any online shop, booking system, customer portal, intranet and business software that runs in a web browser.
Find out who manages each one. This is usually your web developer, hosting provider or software supplier. Check old invoices or emails if you’re not sure.
Ask each provider to confirm the update. Use the questions below so you get a clear answer.
Check your PHP version. If any system runs PHP 8.1 or older, agree an upgrade plan with your provider as a priority.
Watch for updates from software suppliers. The NCSC advises checking for security updates in third-party products that include PHP, such as control panels and business applications.
Keep a note of the answers. A simple record of who confirmed what, and when, is useful for your own peace of mind and for any insurance or compliance checks.

What to ask your website or hosting provider

Have you applied the October 2026 PHP security update to our website and systems?
Which version of PHP are we running now?
If we’re on PHP 8.1 or older, what’s the plan to upgrade, and when?
Have you checked for any signs that our systems were targeted before the update?

If a provider can’t apply the fix quickly, the NCSC advises considering taking the affected system offline until it’s safe, as many organisations did this week.

Local support in Glasgow, Belfast and Dublin

Yellowcom is a business communications and IT provider with local teams in Glasgow, Belfast and Dublin, supporting businesses across Scotland, Northern Ireland and the Republic of Ireland. If you’re not sure where to start with the PHP security update, we can help you work through it.

We know that keeping on top of security updates isn’t always straightforward, especially when you’re busy running a business and your website was set up by someone else years ago. Our local teams can:

Help you understand what to check, in plain English, without the jargon
Speak with your website, hosting or software providers on your behalf to get clear answers
Review your wider IT, network and business systems to see where your business could be better protected
Support you on site or remotely, with local engineers who know the area

There’s no cost and no obligation for an initial conversation. Just a friendly local team ready to help.

Yellowcom office	Region covered	Phone
Glasgow	Scotland	0333 015 6651
Belfast	Northern Ireland	0333 015 6651
Dublin	Republic of Ireland	01 263 5299

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the nickname for two critical PHP security flaws, CVE-2026-109618 and CVE-2026-109619, made public on 21 October 2026. On servers that haven’t been updated, they could allow an attacker to run their own code without logging in. Both are rated 9.2 out of 10 for severity.

Has my website been hacked?

Not necessarily. Being affected by the vulnerability means your website could be at risk, not that it has been attacked. Many websites that went offline this week did so as a precaution. If you’re concerned, ask your hosting provider to check for unusual activity, such as unexpected new files or changes to your site.

Do I need to take my website offline?

Only if the fix can’t be applied quickly. The NCSC advises updating PHP as the priority. If your provider can’t do that straight away, temporarily taking the affected system offline is a sensible precaution until it’s safe.

Does this affect businesses in Ireland and Northern Ireland?

Yes. The vulnerability affects PHP wherever it runs, so businesses in the Republic of Ireland, Northern Ireland, Scotland and the rest of the UK are all affected in the same way. Both the UK NCSC and the National Cyber Security Centre Ireland have issued advisories urging organisations to update.

How long does the PHP update take?

For most websites on a supported PHP version, applying the update is quick and is often done by the hosting provider with little or no downtime. Websites on PHP 8.1 or older need a full upgrade, which can take longer, especially if the site needs testing first.

Is my phone system or broadband affected?

The PHP vulnerability affects web servers and software that use PHP, not phone calls or internet connections themselves. Some business systems and device management panels do use PHP, though, so if you’re unsure about any of your equipment, ask your supplier or speak to your Yellowcom team.

Who is responsible for applying the update?

Usually whoever manages the server your website or system runs on. For most small businesses, that’s the hosting provider or website developer. If you manage your own servers, your IT team or IT partner is responsible.

Sources and official guidance

This article reflects information available on 22 October 2026. Guidance may change as more details are released, so always check the latest official advice.