Securing Your Website Against Critical PHP Vulnerabilities

Security Alert

Securing Your Website Against Critical PHP Vulnerabilities

Critical flaws in PHP, the language behind WordPress, CRM systems and many other web based platforms, are already being targeted. Most proactive providers will have patched by now, but it is worth confirming yours has. Here is what to check and who to ask.

Posted  on

22 October 2026

 

Related Topics

More about Blue Saffron’s Managed Security Services

 

More about Blue Saffron’s Data Backup and Disaster Recovery Services

 

Read our Blog: The cybersecurity risks hiding in plain sight for professional services firms

 

More about Blue Saffron

 

Get In Touch

 

 

 

 

What has happened

As you may be aware, critical security vulnerabilities were identified in PHP this week. PHP is the core programming language behind a large part of the web. That includes many websites (such as WordPress), but also Customer Relationship Management (CRM) systems and plenty of other web based software. You can read the National Cyber Security Centre advisory here: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

Given how serious this is, your web hosting provider and software vendors should already have contacted you about the steps they are taking. Many will also have posted updates on their system status pages. The good news is that proactive vendors will often have applied the patches or put server level protections in place automatically.

What to do now

If you have not heard from your providers yet, we strongly recommend checking that your applications, websites and data are protected. Please work through these steps as soon as possible:

  • Contact your web hosting provider: Ask your hosting support team to confirm they are aware of the PHP vulnerabilities.
  • Request immediate patching: Ask your host to verify that the latest secure PHP patches have been applied to your server environment.
  • Update your website: If you have access, log into your website’s admin dashboard and make sure your CMS (e.g. WordPress), themes and plugins are on their latest versions. This is good practice, but it does not replace the server level PHP fix.
  • Verify security mitigations: If your host has not yet applied the official patch, ask whether they have put server level mitigations or a web application firewall (WAF) in place in the meantime.

If you do not manage your own hosting or software platforms, please forward this to your web developer, IT department or the agency that maintains your site.

Security is a shared responsibility, and acting promptly matters. If you have questions, or want help knowing what to ask your vendors, call us on [phone number].

For full technical details, see the official PHP release notes: https://www.php.net/

Not sure what to ask your hosting provider or software vendors? Get in touch today and we’ll help you know what to ask.