Security Advisory for websites – PHP Vulnerability

A serious security weakness has recently been found in PHP, the software that powers a large share of the world’s websites, including many built on popular platforms such as WordPress. In some cases it could let criminals take control of a website without needing a password. There are already reports of people trying to exploit it, so it’s worth acting quickly.

What should I do?

If you have a website or online system for your business, first find out whether it uses PHP. If you’re not sure, your web developer or hosting company will be able to tell you. Then ask them whether any updates or fixes are needed, and ask them to let you know once they’ve been done.

What we’ve done

We have checked the systems we look after for our clients and fixed any that were affected. However, websites and online applications are often looked after by someone else, such as a web design agency, a hosting company or a software supplier. They will need to confirm that the parts they’re responsible for have been updated too.

Staying protected

This is a good reminder that keeping software up to date is one of the simplest and most effective ways to protect your business. If you’re not sure whether your website is affected, or who to contact, get in touch with us and we’ll be happy to help.

For the technical team

The vulnerability is known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). The PHP project has released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older, unsupported versions may need upgrading or a patch from your vendor.