PSA: Make sure your website patches these PHP vulnerabilities

Earlier this week, a patch to address two PHP-related vulnerabilities was released. The nature of the vulnerabilities were such, that websites and server operators across the globe are now scrambling to ensure the patch has been implemented in order to safeguard the security of online environments.

For those unfamiliar, PHP stands for hypertext preprocessor (no relation to this Hypertext), and is the open-source server-side scripting language designed primarily for web development. As such, it is present on an estimated 70 to 75 percent of websites all over the world.

Consequently, not addressing these vulnerabilities could leave your website more open to attacks from hackers than usual.

“The PHP security team would like to give advance notice of an upcoming security release. It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” PHP.net shared in an update earlier this week.

According to cybersecurity specialists, IT teams and website owners need to act quickly if they have not implemented the patch. Failure to do will have a significant impact on the security of your website and its infrastructure.

“The immediate challenge is not simply installing a patch, but finding and managing every instance where PHP is running. The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it,” noted Don Smith, VP of Threat Intelligence at the Sophos Counter Threat Unit.

“Security teams should prioritise internet-facing systems, confirming which versions are affected as soon as the official advisory is published, and apply the updates without delay. And in line with the advice from NCSC, any vulnerable system that cannot be patched should be isolated from the internet until it can be secured,” he added.

Smith also pointed out that cybercriminals don’t need to do much to exploit these vulnerabilities, with AI in particular supercharging their abilities to target websites and deploy attacks.

“Threat actors move fast, especially with the help of AI and this will likely be a priority target for them over the coming hours and days so it is crucial organisations monitor PHP and web-server processes for unusual processes, command execution or other signs that an attacker may already have gained a foothold,” he emphasised.

Whoever manages the security and server environment of your website, it is important to ensure that they have addressed this PHP issue as quickly as possible.

South African organisations are taking longer to recover from ransomware attacks

[Image – Photo by Miguel Ángel Padriñán Alba on Unsplash]

Let's talk tech!

Get the tech news you want to read. Take our reader survey and tell us how we can help you better.

Take the survey now