Explore this guidance in context: Vulnerability management. Each topic includes an overview, related guides and a working template.

In this article

01What changed on 21 October

On 21 October 2026, the National Cyber Security Centre highlighted critical PHP security issues identified as CVE-2026-109618 and CVE-2026-109619. Its alert directs organisations to vendor updates and recommends identifying PHP installations, with particular attention to internet-facing services. The issues can enable unauthenticated remote command execution under certain conditions; an affected component does not mean every website is exploitable.

This is a 1 November briefing on that published alert. Check the linked NCSC page and your vendor’s current advisory before making a change, because affected releases, fixes and temporary mitigations may be clarified.

02Make a specific request to your provider

  1. List websites, customer portals and applications that use PHP, including PHP bundled inside another product. Record which provider manages each runtime.
  2. Ask the responsible provider whether the two CVEs affect your deployed build and request the relevant vendor advisory, installed package release and update date.
  3. Agree an update or vendor-supported mitigation, an owner and a completion time. Test important customer journeys after the change.
  4. If an exposed affected system cannot be updated or disabled promptly, discuss the risk and any investigation needed with the provider or an incident-response specialist.

03Keep the conclusion proportionate

A public scan may observe a PHP-related header. That observation alone cannot establish the installed package, vendor backports or whether the vulnerable conditions exist. Save the provider’s evidence alongside the scan finding and record exactly what was confirmed. A hidden version header is not evidence that the underlying software was updated.

Sources & further reading

NCSC: Critical security issue affecting PHP — 21 October 2026 (opens in a new tab)Red Hat: Understanding security backporting (opens in a new tab)

Use the linked primary sources for current technical details. Guidance reflects the scope and dates described in this article.

TURN READING INTO ACTION

Put the guidance to work.

Choose a check with the right scope, inspect its observations and follow up with the person who can make the change.

Choose a security check More practical resources