Critical PHP Security Warning : Is Your Website Affected?
By Sam Oakes, GOBO Creative
Those of you who joined us at last month's Cyber Chamber meeting will know I'm not one for scaremongering. But this week the National Cyber Security Centre has issued an alert I think every business with a website needs to hear about.
What's happened?
PHP is the programming language behind a huge number of websites, including many WordPress sites. A critical flaw has been found in it (CVE-2026-109618 and CVE-2026-109619). In certain circumstances, an attacker could exploit it to run their own commands on a web server, without needing a password or any kind of login. A fix has now been released, but a fix only protects you once it has actually been installed.
The NCSC alert was published on 21 October, and it says all versions of PHP are affected, not just old ones. So even if your website was built recently, you shouldn't assume you're in the clear.
Why does this matter to you?
If your website is hacked, the damage goes well beyond a broken page. Attackers can steal customer data, send spam from your domain, plant malware that harms your visitors, or take your site offline. For a small business, that means lost trade and a lot of lost trust.
What should you do?
Find out whether your website runs on PHP. An online tool such as https://doiusephp.com/ can give you a quick answer.
Speak to your web host or whoever built and maintains your site. Ask them directly whether the PHP security update has been applied. If they can't answer clearly, treat that as a warning sign.
Don't ignore older or forgotten sites. An old microsite or a site nobody has logged into for years is exactly the sort of thing that gets missed.
Ask about the temporary fixes. If an update can't be applied straight away, PHP have published temporary mitigations, and your host should know about them.
Want one less thing to worry about?
A lot of the small business websites I come across are on shared hosting that nobody is keeping an eye on. Patching, updates and security all fall on the business owner, usually without them realising.
I build websites on Squarespace, and I'm a Squarespace Platinum Partner. With Squarespace, hosting and security are looked after by Squarespace themselves, so you are never left chasing your host about the latest vulnerability. You also get a website you can easily update yourself.
If you'd like to talk about moving your existing website over to Squarespace, I'd be happy to have a no-obligation chat. I can look at what you have now, explain what a move would involve, and give you a clear picture of the options.
Get in touch: sam@gobocreative.co.uk | 01423 709397 | www.gobocreative.co.uk
Source: National Cyber Security Centre, "Critical security issue affecting PHP", 21 October 2026.
