TL;DR: Two critical PHP vulnerabilities could let attackers take control of systems that haven’t been updated, and they affect far more than websites. Make a list of everything your firm uses that runs PHP, then update it or take it offline until it can be fixed.

What are the critical PHP vulnerabilities?

If you’re reading this, you’ve probably seen the news about two critical PHP vulnerabilities, and attacks are already being reported. They’re known as CVE-2026-109618 and CVE-2026-109619.

PHP is the technology behind a huge number of websites and online systems. Security flaws are scored for severity out of 10, and both of these score 9.2. That is very high.

In simple terms, a criminal could use these flaws to take over a system that hasn’t been updated, with no password needed. So what do you need to do about it?

Where do you start with the PHP vulnerabilities?

An IT support engineer concentrating while performing his work

You need to find every system your firm uses that runs PHP. Write a list, then check it again, because PHP turns up in places most people wouldn’t expect.

Your website

– Around 70% of websites are built with PHP. Ask your web developer if your site uses it, and get it updated today.

Third-party websites and hosting providers

– Any outside website that holds your firm’s information could be affected, such as a client portal. Your hosting provider should be able to tell you where they stand.

Firewalls and security equipment

– The equipment that protects your network can run PHP behind the scenes. Ask your IT team or supplier to check.

Phone systems

– Some VoIP phone systems, including those built on Asterisk, can be affected. Your phone system provider should be able to confirm this for you.

Network monitoring tools and load balancers

– These are systems your IT team uses to keep your network running smoothly. They’re easy to overlook, so make sure they’re on your list.

Routers and storage devices

– Small office routers and home routers can be affected. So can NAS devices, which are the storage boxes some firms use to hold shared files.

Building security systems and printers

– Door entry systems and similar building security can run PHP. Many office printers can too, so add them to the list.

What should you do next?

Suppliers are rushing out emergency updates to fix the problem. For any websites and equipment you manage yourself, update them as soon as possible.

The fixed versions of PHP are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older versions will not get an official fix. If you’re running one of these, move to a supported version or ask your supplier for a patch.

If you can’t update straight away, the UK National Cyber Security Centre advises that you consider taking the system offline until you can.

Think about the impact of the change too. This matters most if a system hasn’t been updated in a long time and is running a very old version. Your web developer and IT team should be able to assess that for you.

Can AI help you check your systems for PHP?

Yes, and it can save a lot of time. Make a list of your network equipment by make and model, then add the software and websites your firm uses.

Ask Copilot to review the list and point out anything likely to run PHP. Then check with each supplier to see if they have already fixed it, or have an update ready for you to install.

Only use AI your firm has approved

Only do this if your firm has approved sharing this kind of information with AI. Use a business AI platform, such as Microsoft 365 Copilot or a paid Claude Team or Enterprise account.

Don’t share more than you need to

The AI only needs the make and model of your equipment and the names of your software. Never include passwords or anything that shows how your network is set up, such as IP addresses or network diagrams.