By: Isuru Parakrama
October 22, World (LNW): A critical security vulnerability in PHP, the programming language underpinning a large proportion of the internet, has triggered an urgent cybersecurity response in the United Kingdom, with websites taken offline as organisations work to protect their systems against potential attacks.
The security issue, disclosed on October 21, has affected websites and online services that rely on vulnerable versions of PHP, including platforms used by government bodies, public institutions and major digital services. Reports have identified disruptions involving several UK local councils, the Metropolitan Police website and websites associated with television programmes, including The Traitors.
The incident has placed renewed attention on the security of widely used internet infrastructure, as organisations face the challenge of applying urgent software updates while maintaining access to essential online services.
PHP is a server-side programming language used to build and operate dynamic websites. It supports major content management systems, including WordPress, Drupal and Joomla, making vulnerabilities in the software potentially significant for organisations across both the public and private sectors.
The UK’s National Cyber Security Centre has issued an alert concerning two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Both have received a severity rating of 9.2 under the CVSS version 4.0 system.
Security researchers have demonstrated that the flaws could allow attackers to execute malicious code remotely without first obtaining authentication. Depending on the affected system and its configuration, successful exploitation could enable an intruder to compromise a server or gain access to sensitive information.
The vulnerabilities are linked to problems involving memory management and the handling of internal software states. Although the underlying weaknesses are technical in nature, their potential consequences extend well beyond individual websites because compromised servers can expose data, disrupt services or provide a foothold for further attacks.
The discovery has prompted organisations to review their exposure and prioritise security updates. The PHP Foundation has released patched versions, and affected organisations have been advised to upgrade to supported releases rather than rely on temporary protective measures.
The recommended fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later releases in the corresponding supported branches. Systems running PHP 8.1 or older versions require particular attention because those releases are no longer supported and do not receive routine security updates.
Where immediate patching is not possible, organisations have been advised to assess their exposure and consider taking vulnerable systems offline until they can be secured. Although such action can interrupt services, leaving a vulnerable server accessible may create a greater risk if attackers exploit the weakness.
The incident also highlights the difficulties faced by smaller organisations and website operators that rely on shared hosting services or third-party providers. In such environments, administrators may have limited control over the underlying software and could depend on hosting companies to install security updates.
For website owners, the immediate priority is to establish which PHP version their systems use, determine whether the hosting provider has applied the relevant fixes and check for any signs of unauthorised activity. Organisations operating websites through content management systems must also ensure that associated software, extensions and server components are properly maintained.
The episode serves as a reminder that cybersecurity depends not only on protecting individual applications but also on maintaining the software infrastructure on which those applications rely. When a widely deployed component develops a critical vulnerability, the consequences can spread rapidly across otherwise unrelated organisations.
As security teams work to close the gaps, the challenge for UK institutions is to restore affected services safely while ensuring that vulnerable systems are not returned to operation without adequate protection.
The UK’s National Cyber Security Centre has urged organisations to identify vulnerable systems, prioritise internet-facing servers and monitor for suspicious activity while applying the necessary updates.
The wider concern is that the same software weakness can affect thousands of independently operated websites, creating a situation in which a single security flaw demands a coordinated response across government, business and technology providers.
While taking websites offline may cause inconvenience to users, the incident demonstrates why security updates and responsible system maintenance are essential to keeping digital services reliable and protecting sensitive information.
