Critical PHP Flaws Put Millions of Websites at Risk - ‘Patch or Go Offline’, Say UK, US and EU Agencies

The NCSC, alongside US and EU cyber agencies, is urging every organisation that runs PHP to patch two critical vulnerabilities this week. PHP is the scripting language behind a very large share of the world’s websites, and the two flaws — CVE–2026–109618 and CVE–2026–109619 — are memory corruption bugs that can let an unauthenticated attacker execute code on a web server running PHP. The NCSC says organisations using any version of PHP are affected, not only outdated ones, and its advice is unusually blunt: update to the latest fixed version, and if a system cannot be patched or mitigated in time, take it offline.

Two further details make this more urgent than a routine patch notice. According to BBC News reporting, Amazon said it had observed attacks attempting to exploit the flaws before the vulnerabilities were publicly disclosed — meaning some attackers may have known about them ahead of the coordinated warning. And the flaws were reportedly uncovered with the help of AI tools, described in reporting as among the most significant security flaws ever found that way, prompting what the BBC called a “rare global cyber–security response”. For UK businesses, the hardest part may not be patching the website they know about. It is finding the PHP they do not: forgotten sites, hosted portals, and appliances that bundle PHP internally without making it obvious. The Dutch national cyber security centre, NCSC–NL, has published an inventory of software products with a PHP dependency precisely because of that.

What the vulnerabilities are, and what the NCSC says to do

Both flaws involve PHP mishandling its own memory while processing web requests. CVE–2026–109618 occurs when out–of–memory handling interrupts PHP while internal request data is only partially initialised; request cleanup can then treat that invalid data as valid. CVE–2026–109619 occurs when request–owned internal state survives after its backing memory has been freed, letting a later request on the same worker use that stale state. In both cases, the consequence can be unauthenticated remote code execution — an attacker running their own commands on the server without needing to log in.

PHP has published a security update fixing both. The NCSC says organisations using any version of PHP are affected and highly encourages updating to the latest fixed version. It has published an eight–point priority action list, which includes identifying all PHP installations — prioritising internet–facing systems — applying vendor updates, and taking systems offline if they cannot be patched or mitigated in time. The PHP Team has also provided temporary mitigations for organisations that cannot update immediately.

The NCSC adds an important step for systems that cannot be updated, disabled or mitigated straight away: assess them for evidence of compromise, including backdoors, before upgrading. That reflects the reports of exploitation before disclosure. If a server was reachable while attackers already knew about the flaws, patching it closes the hole but does not remove anything an attacker may have installed. The NCSC notes that organisations can seek help from an NCSC–assured Cyber Incident Response provider if needed.

The bundling problem is why the NCSC–NL inventory matters. Many appliances and platforms include PHP as an internal component — for example to power a web administration page — without it being obvious to the person using them. Those systems are affected in the same way, but their owners may not think of them as “running PHP” and may depend on the vendor to supply an update. The inventory lists software products with a PHP dependency that may be affected.

There has also been some public disagreement about how the disclosure has been framed. The PHP project has disputed how responsibility for the flaws has been presented, pointing to supply–chain security company Chainguard. Chainguard’s CEO responded that the matter was handled via “coordinated vulnerability disclosure, unless there’s evidence of active exploits in the wild”. The details of that disagreement are for the parties to resolve; for organisations running PHP, they do not change what needs to be done.

How the PHP warning unfolded

The reporting does not give precise dates for each step, so the sequence below describes the order of events rather than exact timings.

The most consequential entry in that sequence is the one before disclosure. When attackers are exploiting a flaw before the world knows about it, even an organisation that patches within hours of the advisory may already have been reached. That is the same pattern seen this autumn with Citrix NetScaler and Cisco’s email gateway, and the response is the same: patch quickly, then look back. It also fits research published in the past few days suggesting that AI is changing how quickly vulnerabilities and gaps in fixes are found.

Where PHP hides in a small business

The chart below is an indicative planning model — not measured data — ranking common places PHP runs in a UK SME by how often they are overlooked when an advisory like this arrives.

The bottom of the chart is the part most businesses think of first, and usually the best covered. A main website on actively managed hosting is likely to be patched quickly by whoever manages it. The risk is concentrated higher up: systems nobody associates with PHP, sites nobody remembers, and products whose vendor has to supply the fix. Those are the ones that remain exposed weeks after an advisory, and they are exactly where an attacker who already knew about the flaws would look.

The shared–hosting row deserves a note. Many small business websites run on shared hosting, where the hosting provider is responsible for updating PHP itself. In that case, patching is largely the provider’s job — but it is still worth confirming with them that the fixed version is in place, and that any applications you run on top, such as a content management system and its plugins, are also current.

Both flaws, the worst kind

Two vulnerabilities, and both have the property that makes a flaw most dangerous on an internet–facing server.

Unauthenticated remote code execution is the category security teams fear most on a public–facing system, because it combines the two worst properties. Anyone who can reach the server can attempt it, without credentials. And success gives the attacker the ability to run their own commands — to read data, plant backdoors, alter the site or use the server to reach other systems. On a web server, which is by definition reachable from the internet, that is about as serious as it gets.

The NCSC’s statement that any version of PHP is affected widens the impact considerably. Many vulnerability advisories apply to particular versions, and organisations already running recent releases can relax. Here, being up to date before the fix was released is not protection; only the fixed version or the provided mitigations are. Every PHP installation, however carefully maintained, needs attention.

The mechanism behind the second flaw also explains why the NCSC encourages checking for compromise. CVE–2026–109619 involves state left behind after memory is freed being used by a later request on the same worker. That is the kind of subtle, timing–dependent bug that is hard to spot by reviewing code and well suited to automated analysis — consistent with reports that AI tools helped find it. It is also the kind of flaw that may leave little trace when exploited, which is why looking for backdoors and unexpected changes matters as much as applying the fix.

Where UK businesses are exposed

The rows below reflect where PHP–related risk typically sits for a UK SME, with badges indicating how much attention each usually needs this week.

The second row is one of the most common findings when businesses do this exercise. Old campaign sites, test copies of a website, and microsites built for an event years ago often remain online, unmaintained, on servers nobody looks at. They run PHP like everything else and are frequently on older software. Taking them offline altogether is often the simplest response, and matches the NCSC’s advice to take systems offline if they cannot be patched in time.

The seventh row matters for recovery. If a website turns out to have been compromised before it was patched, the cleanest fix is often to restore it from a known–good backup taken before the compromise, then patch. That only works if a recent backup of the site’s files and databases exists somewhere separate from the server itself. Many small business websites have no such backup, or rely solely on the hosting provider’s.

What responding properly costs

The bands below are indicative planning figures for UK businesses responding to this advisory — not quotes.

The bottom row is free and the right place to begin, because it mirrors the first item in the NCSC’s own priority list. Most small businesses can identify their main website quickly; the value comes from pushing further — asking the developer what else they built, checking the hosting account for other sites, and looking at what appliances on the network have web admin pages. That list is what turns a vague worry into a specific, finishable job.

Two ways to handle a PHP advisory

The difference between those columns is mostly about knowing what you run. An organisation with an up–to–date list of its PHP installations can act on an advisory like this in hours; one without it spends the first days discovering what it has. Retiring sites that are no longer needed is the single cheapest improvement, because every site taken offline is one fewer thing to patch and one fewer way in. Separate backups and a known route to incident support turn the worst–case outcome — finding a compromise — from a crisis into a manageable process.

Why this one is different

PHP advisories are not unusual. What sets this one apart is the combination of factors around it. The flaws are critical and unauthenticated. They affect any version, not just old ones. Exploitation was reportedly seen before disclosure. And the warning came simultaneously from UK, US and EU agencies, which is rare and reflects how widely PHP is used and how seriously the agencies view the risk.

The reported role of AI in finding the flaws adds a further dimension. Research published in the past few days found that the share of security fixes needing a follow–up because the first patch failed has risen sharply this year, with reporting linking the rise to AI–assisted analysis. Whether the same tools that helped find these PHP flaws will help find gaps in the fixes is an open question. The practical response is the one that research suggests for any fix to an exploited bug: apply it promptly, then keep watching for follow–up advisories over the coming weeks.

The bundled–PHP problem is likely to be the longest tail. Websites and hosting providers will patch quickly. Appliances and products that embed PHP depend on their vendors issuing updates, and some will take longer than others. NCSC–NL’s inventory is a practical tool for working out which products in your estate might be affected; for anything listed that does not yet have an update, restricting access to its web interface — so it is not reachable from the internet or from untrusted parts of the network — is a sensible interim step.

For organisations pursuing Cyber Essentials, this sits squarely within the scheme’s requirement to keep software supported and to apply high–risk and critical security updates promptly. Internet–facing web servers and their software are in scope. The scheme’s emphasis on knowing what software you run is exactly what makes an advisory like this manageable — and a forgotten, unpatched PHP site is precisely the kind of thing it is designed to surface.

The story at a glance

This story connects to several we have covered recently. Terra Security’s research on broken patches explains why fixes to exploited bugs should be watched for follow–ups. Our piece on the end of security through obscurity covers how AI changes what can be found in code. The actively exploited Citrix NetScaler flaws and the Cisco email gateway zero–day both involved exploitation before disclosure, and the same lesson that patching and compromise checks are separate tasks. Our building–system ransomware piece covers devices with hidden software that nobody thinks to patch. And the ConnectWise suspension is a reminder to keep a backup that does not depend on the system it protects.

Frequently asked questions

Cloudswitched

London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.