Critical PHP Security Vulnerabilities: What UK Businesses Need to Know

October 22nd, 2026

Two critical security vulnerabilities affecting PHP, a technology widely used by websites and online applications, have prompted urgent security action around the world. Here’s what businesses need to know and what AMP is doing to protect the systems we manage.

What has happened?

A significant cyber-security issue has been identified affecting PHP, a technology that operates behind the scenes on a large number of websites and web-based applications.

The UK’s National Cyber Security Centre (NCSC) has issued an alert regarding two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and is encouraging UK organisations to take immediate action. Security updates have now been released to address the vulnerabilities. [ncsc.gov.uk], [cert.europa.eu]

The vulnerabilities are particularly serious because, under certain circumstances, they could allow an attacker to execute malicious commands on an affected web server without first needing to authenticate. [ncsc.gov.uk]

For businesses, the important message is simple: systems using PHP should be identified, checked and updated as quickly as possible.

What is PHP and why does this matter?

PHP is a server-side programming language. In simple terms, it is technology that runs in the background of many websites and web applications, helping them generate pages, communicate with databases and process information.

It is also used within a variety of other software products and platforms, meaning a business could potentially rely on PHP without necessarily being aware of it. [ncsc.gov.uk]

This is why the current security warning is receiving significant international attention.

What is the risk?

The concern is that an attacker could potentially exploit a vulnerable system remotely.

The NCSC says the issue can, under certain conditions, result in unauthenticated remote code execution. This means an attacker could potentially cause malicious code to run on an affected server without having legitimate login credentials. [ncsc.gov.uk]

The issue is known to be actively attracting attackers’ attention. Reports indicate that attempts to exploit these vulnerabilities have already been detected.

That makes applying the security updates promptly particularly important.

What is AMP doing?

AMP is actively reviewing the systems under our management and applying the appropriate security updates.

Our technical team is prioritising this work to ensure affected systems are identified, assessed and secured as quickly as possible.

If AMP hosts and manages your website, you do not need to take any action at this time.

We are carrying out the required checks and updates on the systems under our management and will continue to monitor the situation as it develops.

What about services that aren’t managed by AMP?

This is where we recommend businesses take some simple precautions.

Most organisations use numerous third-party websites, applications and cloud-based services as part of their everyday operations.

If an important system isn’t managed by AMP, contact the company responsible for it and ask:

Is your service affected by the current PHP security vulnerabilities?
Have the appropriate security updates been applied?
If not, when will they be applied?
Are affected systems being actively monitored for suspicious activity?

The NCSC specifically recommends identifying systems running PHP, prioritising internet-facing systems, updating to the latest fixed version and continuing to monitor for further security updates. [ncsc.gov.uk]

If you’re unsure whether PHP is being used, don’t guess. Ask your website developer, hosting company, software supplier or IT provider to check.

Could websites and online services go offline?

Potentially, yes.

Some organisations may temporarily take websites or services offline while they carry out emergency security maintenance.

In fact, the NCSC advises that where an affected system cannot immediately be updated or otherwise mitigated, organisations should consider taking it offline until it can be fully secured. [ncsc.gov.uk]

So, if you experience temporary problems accessing a website or online application in the coming days, it doesn’t necessarily mean the service has suffered a cyber attack. It may be the result of precautionary maintenance being carried out by its provider.

What should businesses do now?

You don’t need to panic, but you should take the warning seriously.

We recommend:

1. Check your business-critical online services
Think beyond your main website. Consider web applications and other internet-facing services your organisation relies upon.

2. Find out who manages them
Establish whether they are managed internally, by AMP or by another third-party supplier.

3. Contact third-party providers
Ask whether their systems are affected and whether the necessary security updates have been applied.

4. Prioritise internet-facing systems
This reflects the NCSC’s current advice, as externally accessible systems require particular attention. [ncsc.gov.uk]

5. Don’t delay updates
Where you manage PHP-based infrastructure yourself, follow the official vendor guidance and update to a fixed, supported version as soon as possible. [ncsc.gov.uk], [cert.europa.eu]

Do AMP customers need to do anything?

If your website is hosted and managed by AMP, no action is required from you at this time.

Our team is already carrying out the necessary checks and updates for the systems under our management.

However, if your organisation also uses websites, applications or online services managed by other providers, we recommend checking with those suppliers directly.