You may have seen reports about a serious security issue affecting PHP, the technology that sits behind many websites and online applications.
On 21 October 2026, security updates were released to address two newly identified vulnerabilities in PHP. In simple terms, these weaknesses could allow someone to interfere with a vulnerable web server without first needing to log in. The UK’s National Cyber Security Centre has advised organisations using PHP to act immediately, apply the available updates and monitor their systems closely.
That understandably sounds concerning. Here, we explain what the issue means in practical terms, whether your website could be affected and what you should do next.
What is PHP?
PHP is one of the technologies used behind the scenes to make websites work. It can help a website display content, process forms, connect to databases and manage other functions that visitors rarely see.
The recently identified issue affects PHP itself, rather than a particular website platform or piece of content. This means a website could potentially be affected even if everything appears to be working normally from the outside.
Security updates have now been made available, and organisations using PHP are being advised to update to a fixed version as soon as possible. Where an immediate update is not possible, temporary protections can be applied to reduce the risk. However, these should only be a short-term measure until the full security update can be completed.
Is your website hosted elsewhere? Here's what to do
A website looking and behaving normally does not necessarily mean the PHP software behind it has been updated.
If your website is hosted by another provider, ask them to confirm:
- Whether your website uses PHP
- Which version of PHP it is running
- Whether the relevant security update, or an approved fix from their technology provider, has been installed
- Whether any further action or monitoring is required
It is also worth checking that your website is running a current, fully supported version of PHP. Older versions may require additional work or need to be upgraded before they can be properly protected.
The National Cyber Security Centre recommends identifying all systems that use PHP, including those managed through third-party products and services, and updating them to the latest fixed version.
A temporary safeguard can help reduce the immediate risk, but it is not the same as installing the full security update.
Already working with STM AGENCY?
If your website or web application is affected, you will already have heard from us directly.
Our CODE development team has reviewed the websites and applications we manage, putting the appropriate protection in place or completing the necessary PHP update based on each website’s individual setup.
There is currently no indication that any of the websites or applications we manage have been compromised. We will continue to keep a close eye on the situation and respond to any further guidance.
If there is anything you need to know or do, we will get in touch directly. Otherwise, you can be reassured that this is being taken care of.
Not sure what’s happening behind the scenes of your website?
You don’t need to understand all the technical detail, but you do need to know that someone is keeping an eye on it.
From hosting and maintenance to security updates and ongoing development, our CODE team can help make sure your website stays secure, supported and ready to do its job. Get in touch with our team today.
