If you don’t work in tech, chances are you hadn’t heard of PHP before this incident. It may have sounded like another acronym the techies use. So why has a programming language caused such a fuss?
What is PHP?
Most people may not have heard of PHP, but they interact with it every day online. PHP is a server-side programming language: it runs on a web server to build pages and handle tasks behind the scenes.
PHP is used in popular website platforms such as WordPress and Drupal, and in frameworks such as Symfony.
According to W3Techs, PHP is used by 69.3% of websites whose server-side programming language is known. That’s close to seven in ten. When one technology is used so widely, a serious flaw in it can affect a lot of websites which helps explain why this incident caused so much concern.
The Issue
Researchers uncovered two critical flaws in PHP, exposing systems to potential cyberattacks. OpenAI reports that its model helped identify one flaw, while Wiz independently discovered and reported both. PHP’s maintainers released fixes on 21 October 2026. This highlights how AI can help find security weaknesses, though the same technology could also help attackers develop exploits. PHP has been widely used for decades, but even mature software needs regular security checks and updates.
The response to these vulnerabilities has been significant:
- Some organisations temporarily took websites or services offline, or restricted access, while they worked to apply the fixes.
- PHP released security updates, and organisations had to check that their servers were running a fixed version.
- Software providers and hosting companies also had to check for PHP in the products and services they manage, then provide updates where needed.
- Government cybersecurity agencies issued urgent warnings, advising organisations to update quickly or isolate vulnerable systems if they couldn’t patch them straight away.
- Technical details and early demonstrations of how the flaws could be exploited began circulating, increasing the urgency to secure affected systems.
The concern was that the flaws could let an attacker run code on an affected server without logging in. That could put the information and services hosted on that server at risk.
How do I check if my website is safe from these potential hacks?
You may not be able to see which version of PHP your website is using, but your hosting provider or website developer can check it for you. Ask them to confirm that the server running your site has been updated to fix the PHP vulnerabilities.
You can also:
- Ask which PHP version is running. The fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some hosting providers may apply the fix to an older version, so ask them to confirm that these specific vulnerabilities have been patched.
- Check for updates to your website platform and its add-ons. If you use WordPress, Drupal or another platform, keep its core software, themes and plugins updated too. Some products bundle their own copy of PHP, so check with the provider.
- Ask your host or developer to check for signs of compromise. This is especially important if your site was running a vulnerable version for a while before it was updated.
- If the site can’t be updated straight away, ask your provider what temporary protection they can apply. The UK’s National Cyber Security Centre advises considering taking an affected system offline if it can’t be updated or protected promptly. Temporary measures reduce risk but do not replace installing the fix.
If you’re unsure, contact your hosting provider and ask: “Is the PHP version running my website patched against CVE-2026-109618 and CVE-2026-109619?”
Does this PHP vulnerability mean my website has been hacked?
No. A vulnerable PHP version means a website may be at risk; it does not prove that anyone exploited it or accessed its data. If your site was running an affected version, ask your hosting provider or developer to update it and check for signs of unauthorised activity.
How can I check if my website is protected from the PHP vulnerability?
Ask your hosting provider or website developer which PHP version runs your site and whether it has been patched against both CVEs. Also check that your content management system, plugins and other software are up to date, as some products include their own PHP components.
What should I do if my website host has not updated PHP?
Contact your hosting provider and ask when they will apply the security fix. If they cannot update or protect an affected system promptly, cybersecurity guidance recommends considering temporarily isolating it from the internet until it is secured. Temporary measures can reduce risk, but installing the fix is the complete solution.
