Critical PHP Security Flaw: What UK Businesses Need to Do Right Now

Two critical PHP security flaws were publicly disclosed today, in what cybersecurity experts are calling the most significant PHP security flaw 2026 has seen — and the UK’s National Cyber Security Centre (NCSC) is urging every organisation running PHP to act immediately. Governments across the world are taking websites offline. This is not a routine patch; it is a global cybersecurity emergency.

If your business uses a website, chances are it runs PHP. Here is what you need to know and what to do right now.

What Is the Critical PHP Security Flaw? (2026)

The NCSC has issued a formal alert regarding two critical flaws in the PHP programming language: CVE-2026-109618 and CVE-2026-109619. Both were discovered by AI-powered security research tools developed by cybersecurity firms Wiz and Calif, using OpenAI’s frontier models as part of an initiative called “Patch the Planet”.

The vulnerabilities allow an attacker to trigger an out-of-memory condition in PHP that results in memory corruption. Under certain conditions, this can be exploited to achieve unauthenticated remote code execution — meaning an attacker does not need a login or any credentials. They can potentially run any code they like on your web server.

OpenAI has described this as “one of the most impactful security issues in recent memory.” Cybersecurity company Wiz estimates roughly 70 per cent of the internet is affected, though that figure is unverified. What is not in question is the severity.

CVE-2026-109618 Explained

Out-of-memory handling can interrupt PHP while internal request data is only partially initialised. Request cleanup may then treat that invalid data as valid, creating a corruption window that attackers can exploit.

CVE-2026-109619 Explained

Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker process may use that stale state before normal initialisation resets it — again, potentially exploitable for remote code execution.

Both vulnerabilities are described by the EU Computer Emergency Response Team (CERT-EU) as having the potential for “unauthenticated remote code execution.” That means malware installation, data theft, and complete server compromise are all realistic outcomes if these flaws are exploited.

Which Websites and Organisations Are Affected?

PHP is the foundation of a vast portion of the web. It powers WordPress, Drupal, Joomla, Magento, and countless bespoke web applications. It runs on shared hosting platforms, control panels, and software that does not advertise its PHP dependency.

The impact became visible today as organisations around the world started taking services offline rather than risk exploitation while patching:

• Finland temporarily shut down its government’s public web services.
• The Netherlands’ National Cyber Security Centre, and the lower house of the Dutch parliament (Tweede Kamer), took their websites offline.
• Edinburgh Council’s website became inaccessible.
• Several BBC programme pages including Doctor Who and The Traitors went offline.
• The White House confirmed federal agencies were assessing impact to government systems.
• Japan’s Prime Minister urged organisations to check whether their websites run PHP.

Cloudflare’s chief technology officer reported seeing “early attacks emerging” as of today and is actively updating mitigations.

For Manchester and Sale businesses, the practical concern is straightforward: if your website runs on WordPress, uses a PHP-based CMS, or sits on shared hosting — you are likely affected and need to act.

What Versions of PHP Are Affected?

According to CERT-EU, the vulnerabilities could affect all versions of PHP dating back to PHP 5, which launched in 2004. That is over two decades of PHP releases in scope.

A patch has been issued, but only for the latest supported versions of PHP. The PHP Foundation has released fixes for PHP 8.1 and above. If your server is running PHP 8.0 or older, no official patch exists — and you are being strongly urged to upgrade to a supported version immediately.

This is a significant challenge for many organisations. Older PHP versions often underpin legacy applications that cannot simply be upgraded overnight. The NCSC’s guidance is blunt: if you cannot patch and cannot upgrade, take the system offline until you can.

What Does the NCSC Say to Do?

The NCSC published its formal alert today and its priority actions are clear. We have summarised them below in plain language for Manchester and Sale business owners:

1. Find every system running PHP — including internet-facing websites, internal applications, control panels, and any third-party software you use. Do not assume only “obviously PHP” systems are at risk; many applications bundle PHP without advertising it.
2. Update PHP immediately — upgrade to the latest version of PHP and apply the security patch. For most businesses using a managed hosting provider, this may mean contacting your host today and asking them to confirm they have patched.
3. Monitor third-party vendors — even if your own PHP is patched, plugins, themes, and third-party services may have their own PHP dependencies. Continue monitoring for updates.
4. If you cannot patch right now, take the system offline — this is not optional advice. The NCSC explicitly states that systems which cannot be patched or mitigated should be taken offline until they can be.
5. Check for signs of compromise — if your system has been exposed, look for backdoors and unusual activity before bringing it back online. If you are not confident doing this yourself, engage an NCSC-assured Cyber Incident Response provider.

Don Smith, from the Sophos Counter Threat Unit, told the BBC that the challenge is not just installing a patch — it is finding and managing every instance of PHP running in your environment. “The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it,” he said.

What Should Manchester Businesses Do Right Now?

If you are a business owner in Manchester, Sale, Trafford, or the wider Greater Manchester area and your website is managed by PC Express IT, we are already checking your exposure and will be in touch.

If your IT is managed elsewhere or in-house, here are the immediate steps:

Step 1: Contact Your Hosting Provider Today

Ask them directly: “What version of PHP is our server running, and has the patch for CVE-2026-109618 and CVE-2026-109619 been applied?” A reputable managed hosting provider should be able to confirm this within hours. If they cannot, escalate.

Step 2: Check Your WordPress or CMS Version

If your website runs on WordPress, log in and check for available updates. While WordPress itself is not the vulnerability, it runs on PHP — and the WordPress team will be releasing guidance on compatibility with the patched PHP versions. Keep your WordPress core, themes, and plugins updated.

Step 3: Audit Any Custom Web Applications

If your Manchester business runs bespoke web software — a booking system, client portal, or internal tool built in PHP — contact the developer today. They need to confirm the PHP version and apply the patch. If they are unresponsive or unable to patch quickly, seriously consider taking the application offline temporarily.

Step 4: Watch for Unusual Activity

Given that Cloudflare has already reported early attacks emerging today, review your website logs for unusual traffic patterns, unexpected file changes, or new user accounts you did not create. This is basic incident triage and should be done regardless of whether you believe you have been patched in time.

Step 5: Call Your IT Support Team

If this feels overwhelming, that is completely understandable. This is a major incident moving fast. Our cybersecurity team is available today to help Manchester and Sale businesses assess their exposure, confirm patch status, and manage the response. Do not leave this until tomorrow.

Why This Matters Beyond Today

What makes this vulnerability particularly significant is how it was discovered: by AI. Wiz used GPT-5.6 Sol as part of OpenAI’s Patch the Planet initiative to find flaws that had gone undetected for more than a decade. The vulnerabilities existed for over 20 years without being found by conventional security research.

This is a preview of a new era in cybersecurity. AI will find vulnerabilities faster than ever before — both for defenders and, inevitably, for attackers. The window between disclosure and exploitation is shrinking. The assumption that “we have time to get to it” is increasingly dangerous.

For businesses across Manchester and Sale that rely on web-based systems, this is a moment to reassess whether your cybersecurity posture is keeping pace. Regular patch management, proper managed IT support, and proactive vulnerability monitoring are no longer optional extras — they are baseline requirements.

OpenAI has committed $1 billion in subsidised access to its security tools for frontline defenders, which is a meaningful investment in helping organisations respond to exactly this kind of threat. But tools only help if someone is actively using them on your behalf.

A Note on AI-Discovered Vulnerabilities Going Forward

The PHP incident is unlikely to be the last of its kind. OpenAI has stated that it expects similar findings to “increase sharply in the coming months” as frontier AI models become better at analysing large codebases for security flaws.

This means the security landscape for Manchester businesses is about to accelerate. Patch cycles that used to be measured in weeks will need to be measured in hours for critical vulnerabilities. Organisations without a managed IT support relationship — where someone is watching, patching, and responding on their behalf — will find themselves repeatedly exposed.

If you want a straightforward conversation about your current exposure and what practical steps would close the gaps, talk to the team at PC Express IT. We work with businesses across Sale, Manchester, and Greater Manchester and we are not going to oversell you a solution that does not fit your scale. Our job is to keep your systems running and your data safe — and today is exactly the kind of day that matters.