When was the last time you thought about the software running behind your business website?

Most business owners don't give it much thought. If the website is working, customers can find the business, and online forms are functioning properly, everything seems fine.

But just because a website is working doesn't necessarily mean the technology behind it is secure.

On October 21, 2026, the UK's National Cyber Security Centre (NCSC) issued an urgent warning about two critical vulnerabilities affecting PHP, a programming language widely used in websites and online applications.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could potentially allow attackers to execute malicious code on vulnerable web servers without needing a username or password.

What Business Owners Need to Know

Here are three important things to understand about this security warning:

  • Your business may use PHP without realizing it. Websites, customer portals, and online applications may rely on this technology behind the scenes.
  • A working website isn't necessarily a secure website. Security vulnerabilities can exist even when everything appears to function normally.
  • Someone needs to verify your systems are protected. Your IT provider, website developer, hosting company, or software vendors should determine whether affected systems require security updates.

The immediate priority is identifying and updating vulnerable systems. But this situation also raises a bigger question: Who is responsible for keeping all the technology your business depends on secure?

What Is PHP, and Why Does It Matter to Your Business?

Unless you work in web development, there's a good chance you've never heard of PHP. Yet your business may use it every day.

PHP is a programming language that helps websites and online applications perform tasks behind the scenes. It can process information submitted through online forms, communicate with databases, and generate website content.

It's also used in popular platforms such as WordPress and many other web-based systems.

Imagine someone visiting your website to request an appointment, submit an inquiry, or complete an online form. Depending on how your website was built, PHP might help process that request.

Your customers never see that technology working. Neither do most of your employees.

And that's perfectly normal. Business owners shouldn't have to understand programming languages to operate their businesses.

However, someone does need to understand what technology is being used and how it's being maintained.

What Happened With These PHP Vulnerabilities?

The two vulnerabilities involve problems with how PHP manages computer memory while processing certain requests.

Under specific conditions, these weaknesses could allow an attacker to execute malicious instructions remotely. This is known as remote code execution, and it's a serious category of software vulnerability.

Depending on the affected server's configuration and permissions, successful exploitation could potentially lead to:

  • Unauthorized access to sensitive information or connected resources
  • Disruption of website or application operations
  • Installation of malicious software
  • Additional security risks involving other systems an attacker can reach

One especially concerning aspect is that exploitation may not require an attacker to log in first.

The PHP development team classified both vulnerabilities as critical and released security updates on October 21, 2026.

The fixed versions include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Organizations using older, unsupported versions should also plan to migrate to a supported release.

This doesn't mean every website using PHP has been compromised. Successful exploitation depends on the circumstances, and the existence of vulnerable software doesn't automatically mean an attack has occurred.

However, businesses using affected systems should take prompt action.

Why Small Businesses Should Pay Attention

When major cybersecurity vulnerabilities make the news, it's easy to assume they're primarily a concern for large corporations.

Unfortunately, vulnerabilities in widely used software don't discriminate based on business size.

Attackers can use automated tools to search the internet for potentially vulnerable systems. They're not necessarily looking for a particular company. They're looking for an opportunity.

Consider a small accounting firm whose website was built several years ago by a marketing company. The website still works, so nobody has given much thought to the software supporting it.

But who is checking whether that software is secure?

Or imagine a medical practice that uses an online portal to communicate with patients. The practice has strong protections on its office computers, but the portal is maintained by a separate software vendor.

If a serious vulnerability is discovered in that portal's underlying technology, who determines whether the practice is affected?

These examples don't mean those particular systems are vulnerable. They illustrate how easily businesses can depend on technology maintained by someone outside their organization.

Protecting your business means looking beyond the computers sitting on your employees' desks.

Your websites, online portals, cloud applications, and third-party services can all be part of your cybersecurity risk.

Do You Know What Technology Your Business Is Using?

One of the NCSC's key recommendations is to identify systems running PHP, particularly those accessible from the internet.

That sounds straightforward, but it raises an important question: Do you actually know what software your business relies on?

Think about the technology providers your company works with:

  • An IT company managing your computers and network
  • A website developer or marketing agency maintaining your website
  • A hosting company responsible for web servers
  • Software vendors providing scheduling, accounting, or other business applications
  • Cloud service providers supporting online operations

Each vendor may be responsible for a different part of your technology environment.

When a critical vulnerability is announced, someone needs to determine which systems are affected, whether updates are available, and who is responsible for making the necessary changes.

Without accurate documentation and clearly defined responsibilities, important updates can be overlooked.

This is why technology inventories and vendor coordination are important parts of cybersecurity.

It's difficult to protect systems you don't know exist.

Why Security Updates Can't Always Wait

Most people have postponed a software update at some point.

Maybe you're in the middle of something important, or you don't want to interrupt your work. It's easy to assume an update can wait until tomorrow.

But software updates aren't always about adding features or improving performance. Sometimes they're fixing security weaknesses that attackers could exploit.

With these PHP vulnerabilities, the development team recommends updating affected systems immediately.

However, updating business technology isn't always as straightforward as clicking a button.

An older application may depend on a particular software version. A website update could require compatibility testing, coordination with vendors, or maintenance outside normal business hours.

That's why businesses need a structured process for managing security updates.

When an update can't be installed immediately, qualified IT professionals may need to implement temporary protections while preparing the system for an upgrade.

Temporary protections can help reduce exposure, but they don't completely fix these PHP vulnerabilities. Updating to a fixed version remains the recommended solution.

In particularly serious situations, temporarily taking an affected system offline may be necessary.

The goal is to address security risks promptly while avoiding unnecessary disruption to business operations.

Five Questions Every Business Owner Should Ask Their IT Provider

You don't need to understand PHP or know how to manage a web server yourself.

But when a critical vulnerability is announced, you should feel confident that someone is evaluating its potential impact on your business.

Here are five questions worth asking:

  1. Are any of our websites or applications affected? Determine whether PHP is being used and whether any installations require updates.
  2. Who is responsible for keeping our technology secure? Clarify responsibilities among your IT provider, website developer, hosting company, and software vendors.
  3. Have the necessary security updates been applied? If affected systems are identified, confirm that updates have been completed and verified.
  4. Are we using any outdated or unsupported software? Older applications may no longer receive security updates and could require replacement or migration.
  5. What happens when a new critical vulnerability is discovered? Your business should have a process for identifying security alerts, evaluating risks, coordinating updates, and investigating potential compromises.

You don't necessarily need detailed technical reports for every software update. But you should know that a reliable process exists and that someone is responsible for following through.

What If a System Was Vulnerable Before It Was Updated?

There's one more important consideration.

Installing a security patch fixes the underlying software weakness, but it doesn't necessarily address damage that may have occurred before the update.

If an exposed system shows signs of suspicious activity, additional investigation may be necessary.

That might include:

  • Reviewing security logs for unusual activity
  • Checking for unauthorized access or account changes
  • Looking for suspicious files or modifications
  • Investigating potential signs of malicious software

This doesn't mean businesses should assume they've been hacked simply because vulnerable software was installed.

It means patching and security monitoring serve different purposes, and both matter.

Being able to identify suspicious activity and respond appropriately is an important part of protecting business operations.

The Bigger Lesson for Business Owners

These PHP vulnerabilities are another reminder that cybersecurity isn't something you set up once and forget.

Technology changes. New weaknesses are discovered. Software becomes outdated. Businesses adopt new applications and services, sometimes without fully considering how they'll be maintained.

Even technology that was secure when installed can develop new risks over time.

Being prepared means understanding which systems your business depends on, knowing who maintains them, and having a plan when something needs attention.

At Superior Technical Solutions, we believe good IT support should do more than respond when something breaks. It should help businesses stay informed, manage technology risks, and reduce the likelihood of preventable disruptions.

If you're unsure how your business identifies and manages cybersecurity vulnerabilities, a cybersecurity risk assessment can help uncover potential gaps and identify areas for improvement.

Because finding a security weakness before someone takes advantage of it is always better than discovering it after the damage is done.

Sources and Further Reading