The National Cyber Security Centre in the UK has asked companies to act to fix two very serious security issues in PHP. These issues, called CVE-2026-109618 and CVE-2026-109619, might let bad people run commands on web servers without needing to log in. PHP has made new security updates to solve these problems. Companies are being asked to update their systems as soon as they can.
What Is the Security Issue Affecting PHP?
Before going on the news, one should know what PHP, Hypertext Preprocessor, is. It is a programming language, and with the help of PHP, websites are made, and it helps in running the backend of the websites. The main work is helping the websites process the requests made by the users and to connect the3 database and show the user activity that is purely content-based.
The security vulnerabilities reported recently are related to how PHP handles memory when processing requests. When memory is exhausted, the software might not manage some internal data properly. This may lead to memory corruption, which may provide an attack vector for an attacker to interfere with the system.
The second flaw is about PHP using data even after the memory that held that data has been freed. In some situations, this issue could let an attacker run commands on a server. This kind of attack is called code execution.
Who Is Affected by These Vulnerabilities?
NCSC clearly mentioned that all the organisations that are using the PHP should check the systems and they should apply the security updates as soon as possible. They gave a straight warning that clearly mentions PHP installations across different versions; this makes sure that the organisations are not totally dependent on the old software for the security checks.
The servers are in danger because if an external or unofficial party tries to get in or the server receives a request, then the attacker gets the full power to exploit the server and its vulnerabilities. They can easily gain control over the systems.ย Another important step for the organisations is the checking of the all installed third party softwares and the services which requires the usage of PHP in the background. Some businesses do not use PHP directly, but their website tools are dependent on it.
What Should Organisations Do to Stay Safe?
NCSC has given many measures that can be taken to reduce the risk of cyberattacks associated with these vulnerabilities. The first step for all organisations is to identify whether their systems are using PHP or not, which makes it easy to apply a fix and update the suitable systems to the latest versions. They should continue to check for updates in the future too to keep the systems safe.
There are many businesses that cannot fix the problem immediately, so there is a temporary solution for them, and they should use the temporary fix until the problem is fixed. The fix in the meantime is provided by the PHP Foundation. Companies should safely check if there are signs of a cyber intrusion if their systems were exposed before the patch for the problem. Like checking if there is any suspicious activity or if the attacker has tried anything on the server or tried to gain access in any section.