By The KTech team · Published 29 October 2026
What happened
The National Cyber Security Centre (NCSC) has published an alert, Critical security issue affecting PHP, on 21 October 2026. It asks UK organisations to act quickly on two newly fixed problems, tracked as CVE-2026-109618 and CVE-2026-109619.
PHP is a programming language that runs on web servers and builds the pages you see. WordPress, and many shop and booking systems, are written in it. The NCSC says the flaws could let an attacker run commands on a web server without logging in, under certain conditions.
The fix has already been released by the PHP project. The NCSC's advice is to find where PHP is used, update to the latest fixed version, and deal with websites and services that face the internet first. If an update cannot happen straight away, it points to temporary measures from the PHP Foundation.
The NCSC also notes that some products and hosting services bundle PHP inside them, so updates may need to come from those suppliers rather than from you directly.
What this means for South Hams homes and businesses
- Ask whoever hosts your website, or built it, whether PHP has been updated since 21 October. A short written answer is enough.
- If you are not sure who looks after the site, find out now. Sites nobody owns are the ones that go unpatched.
- Check that your WordPress plugins and themes are still maintained. Abandoned ones tend to cause trouble long after the core software is up to date.
- Keep a recent backup of your site and database somewhere separate from the web host, so you can recover if something does go wrong.
- Treat this as a reminder to put website updates on a regular schedule, the same as you would for the office computers.
Source: NCSC, Critical security issue affecting PHP, published 21 October 2026. Accessed 29 October 2026.
This is our own summary. For the full detail, please read the source above.