The NCSC has urged UK organisations to act immediately on a critical security flaw in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. PHP has published a security update. The flaw may allow attackers to run commands on any web server running PHP.
PHP is a widely used server-side scripting language for web development. It generates dynamic page content, interacts with databases and handles backend application logic. It also forms part of a range of other products.
According to the NCSC, an attacker could trigger an out-of-memory condition that corrupts memory. Under certain conditions, that corruption could allow unauthenticated remote code execution. The flaw has now been fixed.
The NCSC says organisations using any version of PHP are affected. It highly encourages them to update to the latest fixed version. Those on older versions should move to a fully supported release. The NCSC will keep monitoring for any impact on UK organisations.
What it means for your business
Ask your IT supplier, web developer or hosting provider which PHP version your websites and web-based systems run, and whether the fixed version is installed. Check any other software you use that relies on PHP, as the NCSC notes it appears in other products. Read the full PHP security advisory and the NCSC's priority actions, and confirm any older PHP installations have a plan to move to a supported version.
This brief was written automatically from the source above and summarises it. It is not legal, tax or financial advice.