Critical PHP vulnerabilities raise concerns about the security of business websites

When a company decides to create a website, whether to present its services, receive enquiries or sell products, its initial concerns usually revolve around what visitors will see: the presentation, ease of use, available information and the ability to turn a visit into a business opportunity.

That is entirely understandable. A website is, above all, a commercial tool and, for many small businesses, an important investment in their digital presence. What is not always obvious is that behind the pages we see in a browser are several technologies that make the service work, each with its own maintenance and security requirements.

One of these technologies is called PHP. Although the name may be unfamiliar to many business owners, it is widely used in websites, online shops and business applications.

On 21 October, this technology was at the centre of a security alert issued by several European bodies, including the European Union Agency for Cybersecurity (ENISA), following the identification of two vulnerabilities classified as critical.

What was discovered, and why does it matter?

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect certain versions of PHP and could, under specific conditions, allow someone to execute malicious instructions on a server remotely, without needing login credentials.

Understanding the significance of this discovery does not require detailed technical knowledge. It helps, however, to know that PHP enables websites to perform tasks beyond displaying information, such as processing forms, querying databases, managing user sessions and displaying personalised content.

When a security flaw affects this type of technology, the consequences may extend to the applications that depend on it. The actual risk varies according to the installed version, server configuration and security measures in place.

For these vulnerabilities, the PHP security team released updates on 21 October 2026, addressing the problems in supported versions. However, the availability of an update does not mean it has automatically been installed on every server. That depends on how each service is administered.

This is why the news matters to businesses: a website can continue to work normally even when it is running a version of software that needs a security update.

How can you tell whether a website might be affected?

One difficulty with situations like this is that the technology behind a website is not always known to the company that commissioned it, particularly when development, hosting and maintenance were entrusted to different providers.

Consider a small company that commissioned its website several years ago and has since only needed to update photographs, change business information or add new services. Everything may still work as expected, with no apparent reason to question the underlying technology.

This does not necessarily mean the website is unprotected. Many providers carry out updates and maintenance regularly. Equally, however, it does not establish that every security fix has been applied.

For the vulnerabilities now disclosed, the safest way to clarify the situation is to contact the technical person responsible for the website or hosting and ask them to confirm the PHP version in use, whether it is covered by the alert and whether the necessary updates have been installed.

This check is especially important for services accessible over the Internet, since their public exposure may make attempts to exploit known vulnerabilities easier.

What consequences can a security vulnerability have?

The impact of a vulnerability depends on several factors. It would be incorrect to claim that all affected websites face the same consequences, or that the existence of a flaw inevitably leads to an attack.

Nonetheless, when a vulnerability allows code to run on a server, the potential consequences can be serious, particularly if the compromised system has access to customer information, administrative functions or other resources essential to the business.

For an online shop, for example, a security incident might require temporarily suspending the service while the integrity of the systems is checked. For a business website, certain functions might need to be interrupted, possible unauthorised changes investigated or information restored from backups.

Even without data loss, an interruption can cause operational difficulties, delays in responding to customers and missed commercial opportunities, particularly for businesses that depend on digital channels to receive orders or enquiries.

For this reason, technology maintenance should be regarded as part of the normal operation of a digital service, just as it is for other equipment and infrastructure used daily by a company.

What can small businesses do?

The good news is that preventing many security problems does not require business owners to have advanced IT skills. It does benefit from having a clear relationship with the people who develop, host or maintain their systems.

For this particular alert, the first step is to identify which services use PHP and confirm that their versions are up to date. If that information is not available internally, it should be requested from the responsible provider, along with confirmation of the measures taken.

It is also advisable to clarify whether maintenance is included in the service agreement, what types of updates are covered and how security alerts requiring urgent action are handled.

These questions matter because website development, hosting and application maintenance can be separate services, and they are not necessarily included in the same contract.

Beyond updates, it is important to ensure that appropriate backups exist, that information can be restored when necessary and that a technical contact has been designated for unexpected situations.

Such procedures do not remove every risk, but they enable a faster and more organised response when a vulnerability or operational problem arises.

A matter of continuity and trust

The growing use of digital tools has brought significant opportunities to small businesses, helping them reach new customers, automate tasks and carry out activities that once required considerably greater resources.

This progress has also made many companies more dependent on systems whose complexity is not immediately visible. That reinforces the importance of ensuring that technology continues to receive the attention it needs after it is put into service.

The recently identified PHP vulnerabilities illustrate this reality. They remind us that security depends not only on the initial quality of a website, but also on the ongoing attention it receives.

For anyone running a business, the priority is not to master the technical language of every security alert. It is to know that the systems they use are being monitored, that someone is responsible for maintaining them and that identified problems can be addressed promptly.

Technology should, after all, allow a company to focus on its work without losing sight of the care required to keep it operating securely.

Do you know when your website last received a security update?

It is a simple question, but one that can help reveal how well your company’s digital infrastructure is being maintained.

At TISEC, we support organisations in identifying vulnerabilities, assessing technology risks and defining improvement measures, seeking solutions suited to each business’s needs and size.

If you would like to clarify the security status of your systems or understand which checks may be necessary, contact us for an initial assessment of your needs.

Sources: European Union Agency for Cybersecurity (ENISA), statement of 21 October 2026; CERT-EU, security advisory updated on 23 October 2026.