UK businesses warned over critical PHP flaws affecting WordPress, Magento and web applications

UK authorities are assessing the country’s exposure to two serious software vulnerabilities that could allow hackers to take control of websites and online services.

The National Cyber Security Centre (NCSC) issued a warning on 21 October, urging organisations to check their systems for affected versions of PHP, a programming language widely used to run websites and online applications.

The vulnerabilities could let attackers run malicious code on affected servers without login credentials.

Security updates are available, but organisations must first establish which systems use the vulnerable software. The NCSC has advised those unable to apply the fixes immediately to “consider taking the system offline until it can be fully mitigated.”

Websites in the UK and Europe taken offline as organisations respond to critical PHP vulnerabilities

In the UK, Edinburgh Council’s website and BBC programme websites, including those for Doctor Who and The Traitors, were disrupted, the BBC reported. However, it is not clear whether the PHP vulnerabilities caused the outages.

Several websites across Europe were unavailable on Wednesday as authorities investigated the threat.

Sky News reported that Finnish state IT services provider Valtori had taken government public network services offline as a precaution.

The Netherlands published an official government statement confirming that several government websites had been taken offline because of the PHP vulnerabilities. The Dutch government said the shutdowns were precautionary and that it had no indication of active exploitation at the time of the announcement. 

Two critical PHP vulnerabilities identified

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, each have a severity score of 9.2 out of 10, according to an NHS England cyber security alert.

In a joint statement published on 21 October, the European Union Agency for Cybersecurity (ENISA), the European Commission, CERT-EU, Europol and national cybersecurity authorities warned that attackers could exploit the flaws remotely.

PHP powers many commercial and public-sector websites. It also supports content management and e-commerce platforms, including WordPress, Drupal and Magento.

The vulnerabilities affect several PHP versions. Updated versions have been released, although organisations running older software may need to upgrade or seek fixes from their suppliers.

Technical guidance from CERT-EU sets out the affected software and recommended action.

Cloudflare detects attempted attacks

Researchers at cybersecurity companies Wiz and Calif discovered the flaws using artificial intelligence tools. The weaknesses had reportedly gone undetected for more than a decade.

Wiz Research published its detailed findings and confirmed that Wiz worked with Calif, OpenAI and the PHP team on discovery, coordination and patch verification.

Cloudflare reported attempted attacks shortly after details of the vulnerabilities became public.

In a technical report published Wednesday, Cloudflare confirmed it detected malicious traffic targeting the flaws and deployed firewall protections for customers.

The company warned that these measures were temporary and advised website operators to install the PHP updates.

Chief technology officer Dane Knecht said the company was updating its protections as new attack methods emerged.

UK organisations advised to check suppliers

The warning extends to organisations that rely on PHP-based applications supplied or managed by third parties.

This includes companies in aerospace, defence and other industries that use web applications for business operations, customer services and supplier communications.

The NCSC has advised organisations to check internet-facing systems first, review logs for suspicious activity and contact suppliers where necessary.

The Canadian Centre for Cyber Security has issued similar advice, recommending checks for unauthorised access, unexpected processes and unusual network connections.

UK organisations are being asked to establish their exposure and install the available fixes.