On 21 October 2026 the PHP project released emergency security updates for two critical flaws that could let an attacker run commands on a web server. The UK's National Cyber Security Centre (NCSC) has issued an alert. If your website is hosted by Aqueous, the short version is: your site runs PHP 8.4, a supported version that has a fix, and our hosting partner IONOS will apply the patches immediately. You do not need to do anything.
What has happened
PHP is the programming language behind WordPress and a large share of the web. Two serious vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were found in PHP itself rather than in any one website or plugin.
The NCSC alert explains that an attacker could trigger an out-of-memory condition in PHP, causing memory corruption. Under certain conditions this could allow unauthenticated remote code execution, meaning an attacker could run commands on the server without needing a login. The NCSC says organisations using PHP 5 onward are affected.
Security firm Sansec, which nicknamed the attack chain "php2shell", describes the same two flaws as critical and reports that they affect web servers running PHP 5.4 or later.
The fix
PHP published patched releases on 21 October 2026 for every supported branch: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to the PHP project, all users are strongly encouraged to update immediately, and there is no complete workaround, so updating is the only safe option. PHP 8.1 and older no longer receive updates from the PHP project, so they will not get a fix.
What this means for Aqueous customers
- All websites hosted by Aqueous run PHP 8.4. That is a supported branch, and 8.4.27 is the patched release.
- IONOS, our hosting partner, manages PHP on its servers and will apply the patches immediately. There is nothing to install and no password to change.
- We are monitoring the rollout and will contact you directly if anything needs your attention.
What the NCSC advises
The NCSC's guidance for organisations is to:
- find every PHP installation, starting with anything reachable from the internet, and not assume only old versions are at risk
- update PHP to the latest version, and watch for updates to any products that bundle PHP
- if you cannot update straight away, apply the PHP team's temporary mitigations, or take the system offline
- if a system cannot be updated or protected, check it for signs of compromise and backdoors
If your website is hosted somewhere else
- Check your PHP version. It is usually shown in your hosting control panel. Ask your host to confirm it has installed the 21 October security update, or an equivalent fix for your version.
- Move off PHP 8.1 or older. These versions will not be patched. Older websites and plugins sometimes need testing before a PHP upgrade, which is something we can do for you.
- Look beyond your main site. Old staging sites, forgotten subdomains and test installations also run PHP.
- Keep WordPress up to date. Core, plugins and themes should all be current, with recent backups in place.
- Watch for warning signs. Unfamiliar files, new admin users you did not create, unexpected redirects or strange emails sent from your domain all deserve a closer look.
Need help?
If you would like us to check your PHP version, move your site to secure, managed hosting, or investigate a site you think has been compromised, see our WordPress fixes and hacked site repair service or get in touch.
This situation is developing quickly. This article was published on 21 October 2026 and reflects the information available that day.