This scenario is illustrative. A 25-person engineering practice has a WordPress website that a freelancer built five years ago. It sits on a shared hosting plan, and the directors assume the host “handles security”. After reading a news alert, the office manager emails the host and finds that the platform has been updated, but the site is pinned to an older PHP version because a plugin needed it years ago. Nobody had looked since.
That’s the real problem behind most patching stories. The fix exists. The question is whether anyone is responsible for applying it.
On 21 October 2026, the UK’s National Cyber Security Centre (NCSC) urged organisations to act quickly on two critical vulnerabilities in PHP, the programming language behind a large share of the web, including WordPress. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and relate to how PHP handles memory during web requests.
The NCSC says the issue “may allow attackers to execute commands” and that “organisations using any version of PHP are affected.” The problem has been fixed in updated versions of PHP. At the time of writing, the NCSC’s alert does not say the flaws are being exploited, but its message is clear: act quickly rather than wait.
Large organisations have teams that track alerts and patch within days. Smaller businesses often don’t, and three things tend to get in the way:
• Unclear ownership. The site was built by an agency, hosted by a provider and last touched by someone who has since left. Each party assumes another is dealing with it.
• Hidden PHP. It isn’t only in websites. Client portals, booking systems and the management pages of some network appliances can include it. The NCSC specifically warns that third-party products may bundle PHP.
• “It still works.” An unpatched website looks exactly the same as a patched one, right up until it’s compromised.
A compromised website can be used to steal customer data, spread malware to visitors, send spam that damages your email reputation, or give an attacker a foothold in your wider network. For architecture, engineering and construction firms, where client portals and project file-sharing are common, the impact reaches clients too.
The NCSC’s recommendations translate into a short checklist any business can work through:
1. List everything that faces the internet: your main website, microsites, client portals, booking systems and remote management pages. Start with these, as the NCSC advises.
2. Write down who patches each one: web host, agency, IT provider or your own team.
3. Ask them directly: “Have you applied the PHP updates following the NCSC alert of 21 October?” Get the answer in writing.
4. Update to the latest supported version. Test your site afterwards, as older plugins and themes can break on newer versions.
5. If you can’t update yet, mitigate. The PHP Foundation has published temporary mitigations. If those aren’t possible, the NCSC says to “consider taking the system offline until it can be fully mitigated.”
6. Check for signs of compromise, including backdoors, before you upgrade. Look for unfamiliar admin accounts, files you don’t recognise and unexpected changes.
7. Ask your vendors whether their appliances or hosted services include PHP, and watch for their security updates.
This alert won’t be the last. The businesses that handle these moments calmly have three things in place: an up-to-date list of their systems, a named owner for each one, and a regular patching rhythm that covers servers, laptops, network devices and websites alike. Monthly reviews, with a faster route for critical alerts, are a sensible starting point for most SMEs.
It also helps to agree in advance what happens when a critical alert lands. Who reads it? Who decides whether a system needs to come offline? Who tells clients if a portal is unavailable for a day? Answering those questions on a quiet Tuesday is far easier than answering them during an incident, and it turns a worrying headline into a short, well-practised routine.
Alerts like this are where a managed IT partner earns its keep. We can help you:
• Map everything your business has facing the internet, including websites and portals.
• Agree clear patching responsibilities with your web host, agency and other suppliers.
• Manage updates across servers, endpoints, network devices and websites.
• Spot suspicious activity around the clock with our 24x7x365 SOC and MDR service.
• Build patching and system lifecycles into your 12-month IT roadmap.
• The NCSC has urged UK organisations to act quickly on two critical PHP vulnerabilities.
• PHP runs much of the web, including WordPress, and can hide inside portals and appliances.
• Fixes exist, but they only protect you once someone applies them.
• Name an owner for every internet-facing system and ask them to confirm in writing.
• Make patching a regular routine rather than a reaction to the headlines.
Book a free 30-minute security check. Call us on +44 204 570 2770 or email hello@zuri-it.com, and we’ll help you find where PHP is running, who’s responsible for it and what to fix first.