- 78 Bridge St, Ramsbottom, Bury BL0 9AG
Updated: 22 October 2026
An urgent cyber security warning has been issued following the discovery of two critical vulnerabilities affecting PHP, the technology used by millions of websites, including those built using WordPress.
The UK’s National Cyber Security Centre (NCSC) has urged organisations to take immediate action to protect their websites and IT systems.
At Munro-Greenhalgh, we are encouraging all our business clients to check with their IT providers or website hosting companies to establish whether they are affected.
On 21 October 2026, the PHP development team released emergency security updates to address two serious vulnerabilities, collectively referred to as PHP2Shell.
The vulnerabilities are identified as:
CVE-2026-109618
CVE-2026-109619
Both have received a critical severity rating of 9.2 out of 10.
In simple terms, these weaknesses could allow cybercriminals to gain unauthorised access to vulnerable web servers, potentially without needing a password or other login credentials.
PHP is used behind the scenes by many business websites, including WordPress websites, online shops and other web applications.
If these vulnerabilities are successfully exploited, the consequences could include:
Data breaches: Theft of customer information, confidential business data or login credentials.
Business interruption: Websites, booking systems or online sales platforms becoming unavailable.
Cyber extortion: Criminals gaining access to systems and potentially demanding payment.
Financial losses: Costs associated with investigating, containing and recovering from a cyberattack.
Reputational damage: Loss of customer confidence following a security incident.
Importantly, these vulnerabilities exist within PHP itself, rather than being specific to WordPress or an individual website.
You do not need to understand the technical details, but you should contact your IT department, website developer or hosting provider and ask them to confirm the following:
Does our website or any other business system use PHP?
Which version of PHP are we currently running?
Have the emergency security updates released on 21 October 2026 been installed?
Has our hosting provider confirmed that the affected systems are protected?
Have security logs been checked for evidence of attempted or successful exploitation?
Are there any further security updates or protective measures we need to implement?
We recommend obtaining written confirmation from your IT provider that the appropriate checks and updates have been completed.
The PHP development team has released the following security updates:
| PHP version | Security update |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Businesses using older versions should seek urgent advice about upgrading to a supported version or obtaining an appropriate vendor-supplied security fix.
If immediate updating is not possible, your IT provider should assess temporary protective measures. In some circumstances, temporarily taking an affected system offline may be necessary.
A web application firewall may provide additional protection, but it should not be treated as a replacement for installing the security updates.
WordPress is one of the most widely used website platforms and relies on PHP.
However, this is not a vulnerability within WordPress itself. Updating WordPress plugins or themes alone will not resolve the underlying PHP security issues.
Your website hosting provider should be able to confirm which PHP version your website uses and whether the necessary security updates have been applied.
Cyber Insurance can play an important role in helping businesses respond to cyber incidents.
Depending on the policy, cover may include:
Specialist IT forensic investigations and incident response.
Recovery of computer systems and data.
Business interruption and loss of income following an insured cyber incident.
Cyber extortion and ransomware response.
Legal assistance and data breach notification costs.
Liability arising from certain data security and privacy breaches.
However, Cyber Insurance is not a substitute for maintaining appropriate IT security, and cover will always depend on the individual policy terms, conditions and exclusions.
Businesses should also be aware of their obligations to disclose relevant information to insurers and comply with applicable policy conditions.
Some Munro-Greenhalgh clients insured through specialist cyber insurer Coalition benefit from proactive cyber security monitoring and Zero Day Alerts.
These alerts are designed to identify emerging vulnerabilities and warn businesses where action may be necessary.
If you receive a security alert from your cyber insurer, verify that the communication is genuine and arrange for your IT provider to investigate promptly.
Cyber threats are constantly evolving, and even businesses with relatively simple websites can be exposed.
Our advice is straightforward:
Speak to your IT provider today, establish whether your systems are affected and obtain confirmation that the necessary security updates have been applied.
You do not need to become a cybersecurity expert, but you do need to make sure the people responsible for your systems are taking appropriate action.
Munro-Greenhalgh is an independent, award-winning insurance broker based in Ramsbottom, Bury, advising businesses throughout Greater Manchester, Lancashire and across the UK.
We help businesses understand their cyber exposures and arrange appropriate Cyber Insurance protection from established and specialist insurers.
If you would like to discuss your business’s Cyber Insurance arrangements, please contact our team on 01706 824023.
For the latest technical guidance, refer to the UK National Cyber Security Centre and the official PHP security advisory.
Sources
UK National Cyber Security Centre: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
PHP official security announcements: https://www.php.net/archive/2026.php
WordPress security guidance: https://wordpress.org/news/2026/10/critical-php-security-release/
