LUCAMEThe National Cyber Security Centre has issued urgent guidance to UK organisations about two serious vulnerabilities in PHP, the programming language that underpins a large proportion of websites and web-based applications. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to compromise systems running affected versions of PHP. Organisations are being urged to act without delay rather than wait for scheduled maintenance windows.
What this means for your business
If your website, client portal, or any web-based software your business relies on runs on PHP, it may be exposed until the relevant patches are applied. Contact your IT provider or web host today to confirm whether your systems are affected and to get updates installed as a priority. Do not assume the issue will be handled automatically - ask for written confirmation that patching has been completed.