The National Cyber Security Centre (NCSC) is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.
PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user's browser. PHP is also used in a range of other products.
The security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed.
The full PHP security advisory provides more details regarding the fixed security issue.
The NCSC will continue to monitor for any impact on UK organisations.
Read the full news item from NCSC: Critical security issue affecting PHP | National Cyber Security Centre.
Further NCSC resources:
- NCSC blog post: Preparing for a ‘vulnerability patch wave’
- Follow NCSC guidance including vulnerability management and preventing lateral movement
- NCSC principles secure build and deployment pipelines
- If your organisation is in the UK, you can sign up to the free NCSC Early Warning service to receive notifications of potential threats on your network
- The NCSC Vulnerability Disclosure Toolkit helps organisations of all sizes with the essential components of implementing a vulnerability disclosure process
Cyber attacks can disrupt operations, compromise sensitive data, and damage reputation. Read the Business Wales Cyber Security Advice and Support page to find out how to protect your business from a cyber attack.