Last week saw 32 government services unavailable due to the PHP global cyber-security issue and the National Cyber Security Centre (NCSC) recommended that businesses tackle the problem immediately.
Websites around the world were taken offline until the security issue was fixed. Organisations using any version of PHP are affected and all organisations are warned to update to the latest fixed version.
OpenAI detected flaws in the ubiquitous PHP (PHP Hypertext Preprocessor), a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user's browser.
While the non-profit organisation called the PHP Foundation, which maintains and develops the language, was preparing a security patch, an online leak made the problem common knowledge before it had been released.
The security issue could allow an attacker to trigger an Out-Of-Memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution.
What organisations should do
If a business has not already taken the recommended actions outlined by the NCSC, these are the steps that should be followed.
The PHP Foundation has released two patches for the software elements and companies can identify the flawed code in PHP as:
- The CVE-2026-109618 process handles out-of-memory issues and can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
- The CVE-2026-109619 process flaw means a request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialisation resets it.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the two critical vulnerabilities that can allow unauthenticated remote code execution.
If companies haven’t already done so, they should contact both their website manager and the company providing server hosting.
It is also a lesson as to why software should be continually updated and why to avoid unsupported legacy systems.
The NCSC highly encourages organisations to follow these priority actions:
- Identify systems running PHP across your infrastructure, prioritising internet-facing systems. As all versions may be affected, do not limit discovery to outdated PHP versions; identify PHP installations generally and assess their exposure to CVE-2026-109618 and CVE-2026-109619.
- Update to the latest version of PHP and continue to monitor for future updates.
- If you are unable to update to a version with the security update applied, the PHP Foundation have provided temporary mitigations.
- If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.
- If you are unable to update or disable the system immediately, you should assess the system for any evidence of compromise prior to your upgrade or mitigation and look for backdoors installed by an attacker. If you are not confident in your ability to do this internally, then you can get assistance from an NCSC-assured Cyber Incident Response provider.
- Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP. NCSC-NL have published an inventory list of software products with a PHP dependency potentially affected by the vulnerabilities. Apply relevant updates as they become available.
PHP was developed in the early 1990s to help serve dynamic web pages and applications. It is used by website content management systems like Joomla, Drupal and WordPress.
Get an NCSC-assured Cyber Incident Response company: https://www.ncsc.gov.uk/schemes/cyber-incident-response/find-a-provider
PHP Foundation page: https://www.php.net/index.php