Critical PHP vulnerability: what it means for your business

Two critical security flaws in PHP, the technology behind a large share of the world's websites, are being exploited. Here's what's happened, why it matters even if you don't think of yourself as a tech business, and the practical steps to take.

What happened?

On 21^st October, PHP released emergency security updates to fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), now widely referred to as ‘PHP2Shell’. The UK's National Cyber Security Centre (NCSC) has issued an alert encouraging organisations to take immediate action.

If exploited, the flaws could allow an attacker to run commands on a web server that uses PHP. From there, they could install malware, steal login details or access data. Details of the vulnerabilities have leaked and attackers are actively targeting them, which is why some organisations took their websites offline yesterday until they could be patched.

Why it matters to your business

PHP sits behind a large proportion of websites, including many built on WordPress. It powers the parts of a site that handle logins, contact and booking forms, client portals, file uploads and databases.

It's also built into lots of other software and devices, so you could be affected even if you've never heard of PHP. You don't need to be a technology business to be at risk. If you have a website, an online portal or rely on third-party software, it's worth checking.

What to do now

Based on NCSC guidance and general good practice, these are the practical steps:

1. Find out if you use PHP. List your websites and web applications, starting with anything public-facing.
2. Update it. Install the latest PHP security release. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
3. Can't update straight away? The PHP Foundation has published temporary mitigations. The NCSC advises considering taking the system offline until it can be fixed.
4. Check third-party software. Ask suppliers whether their products or devices include PHP and what they're doing about it.
5. Watch for unusual activity. Look out for unexpected logins, new admin accounts or data moving where it shouldn't.
6. Reset passwords if in doubt. If you think a system may have been compromised, change passwords on key accounts, starting with admin logins.
7. Check your backups. Make sure they're up to date, stored separately and can actually be restored.
   

Website managed by someone else?

Most businesses don't host their own website, so the fix will sit with your web agency, hosting provider or IT support. It's worth contacting them today and asking:

• Do any of our websites or systems use PHP?
• Have they been updated to a fixed version, and when?
• Have you checked for any signs of compromise?
• Are any other products you provide to us affected?

Already have Cyber insurance?

Your insurer may contact you directly about this vulnerability. If they do, follow their instructions and apply the recommended updates.

If you think you've been affected, contact your insurer or your SRG contact as soon as possible. Many cyber policies include access to an incident response helpline, and most require prompt notification, so check your policy conditions.

Don't have Cyber cover?

Incidents like this show how exposed businesses are to cyber threats, often through technology they didn't know they relied on. Cyber insurance is one way businesses manage that risk.

Depending on the policy, cover can include restoring data and systems, lost income and extra costs following an incident. Just as importantly, many policies give you access to specialist support when something goes wrong, which can help limit the damage to your reputation. That can include:

• forensic IT investigation
• legal advice
• PR and communications support
• help with notifying regulators
• credit monitoring for affected individuals
• forensic accounting

All cover is subject to the policy terms, conditions, limits and exclusions, and what's included varies between insurers.

Don't have Cyber cover?

If you're not sure where to start, or you'd like to talk through your cyber risk and cover, get in touch with your usual SRG contact or visit our contact us page.

Further reading: NCSC alert · Joint EU statement (ENISA)