Two Critical PHP Flaws Demand Immediate Action from UK Small Businesses

Two Critical PHP Flaws Demand Immediate Action from UK Small Businesses

•

Episode description

Two Critical PHP Flaws Demand Immediate Action from UK Small Businesses

On 21 October 2026, the PHP security team announced an emergency release to patch two critical vulnerabilities scoring 9.2 out of 10. Security researchers confirmed the flaws could enable remote code execution, and early attack activity has been reported. The UK’s National Cyber Security Centre advised organisations to prepare to patch immediately or consider taking vulnerable systems offline. For small businesses running PHP-based websites and applications (including WordPress, Drupal, Joomla and Magento), the question is stark: who is actually responsible for securing your web infrastructure? This episode cuts through the noise to explain what we know, what remains unconfirmed, and why the biggest risk may not be the vulnerability itself but the absence of clear accountability. Noel Bradford challenges business owners and IT providers to establish who owns website security, verify PHP versions, confirm patching plans, and demand straightforward answers before the next critical flaw arrives. Because paying for hosting is not the same as paying for security, and technical debt has a habit of presenting its invoice at the worst possible moment.

Chapters

  • Cold Open Two critical PHP vulnerabilities scoring 9.2 are receiving emergency fixes. The UK National Cyber Security Centre is advising organisations to patch immediately or consider taking systems offline, and attackers have already started probing for exposure.
  • The Clock Is Ticking The PHP security team brought forward its disclosure timetable after researchers confirmed the flaws were real. Remote code execution is possible, but official technical details and affected version ranges have not yet been published. Distinguishing confirmed facts from speculation matters.
  • The Really Nasty Bit Cloudflare reports early attack activity whilst Huntress had not observed exploitation across its partner base. Once fixes are public, attackers can reverse-engineer the vulnerabilities. Many small businesses have no clear answer about who secures their PHP-based websites.
  • What You Need To Do Right Now Identify who is responsible for your website security. Contact them today and ask which PHP version you are running, whether you are affected, and when fixes will be applied. Demand confirmation, not reassurance. If systems cannot be secured promptly, consider restricting access.
  • The Real Problem This is not just a PHP problem but a responsibility problem. Businesses often pay multiple providers yet cannot identify who owns security. If you can name who invoices you but not who secures your website, you have identified a business risk.
  • Final Word Before the end of the day, confirm who is responsible for your website security and what they are doing about these vulnerabilities. If you cannot get a straight answer, you have a bigger problem than two security flaws. Get it sorted before someone else does.

Links