CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (critical)session.upload_progress.enabled=0 and restart PHP. A partial mitigation only.Imagine someone gaining access to your website without even attempting to guess your password.
That is the risk posed by newly disclosed critical vulnerabilities in PHP, the technology behind a huge part of the web.
One of the affected features sounds almost harmless: upload progress tracking. Simply put, it helps a website tell someone how their file upload is progressing.
Researchers found serious bugs in how PHP handles memory and failed requests, including within this upload-progress functionality. These could allow an attacker to run their own code on an affected server without a password. Depending on the server’s configuration and permissions, that could mean compromising your website, accessing sensitive information and potentially taking control of the server.
Alongside this, a separate incident involving compromised certificate-authority keys has raised another concern. A certificate authority helps provide the digital certificates your browser uses to check that it is communicating with the genuine website.
When those keys are compromised, attackers may be able to create certificates that impersonate legitimate services. If they can also intercept your connection, and your device accepts the fraudulent certificate, you could believe you are communicating securely with the real website while someone else is sitting in the middle.
These are separate issues, but together they underline something important: a familiar-looking website and a password are not, on their own, enough to keep you safe.
For the PHP vulnerabilities, the UK’s National Cyber Security Centre is urging organisations to take immediate action.
Here’s why websites and apps like yours may be vulnerable
We’re going to be controversial for a moment: we actually like PHP. It is a very powerful language, and it has its place in the ecosystem.
And we have long appreciated WordPress. Indeed, we have used it ourselves for certain websites.
In its day, WordPress catapulted businesses with small budgets from very simple, outdated-looking websites to something flashy and impressive. Downloadable templates (many free, some paid for, with fancy, swishy features) made a huge difference to what people could achieve.
We know plenty of people who followed a few online courses and built their own WordPress websites. That opened doors for businesses and organisations that otherwise might never have been able to afford a professionally designed website.
WordPress started as a blogging platform and developed into a powerful content management system. Being able to log in and change your own pages was a big part of its appeal.
But here is the problem.
On the day it is installed, everything may be up to date, shiny and new. Then it starts needing TLC. Leave it without maintenance and it can age faster than a car that has never seen an oil change in its life.
The website might still look exactly the same from the outside. Underneath, however, WordPress, its templates, its plugins and the software running on the server all need attention.
That doesn’t make WordPress a bad product. It means you have taken on a system that needs looking after.
What has often happened is that a website designer was given a job, without being given a maintenance contract. The website was delivered, the invoice was paid, and everyone moved on.
You then have a computer program running on a server that isn’t being updated.
And this latest PHP issue is not limited to neglected WordPress websites.
Researchers demonstrated attacks against current WordPress, Drupal and Joomla deployments. The vulnerabilities are in PHP underneath them, so even an up-to-date website application can be affected if its PHP installation has not received the security fix.
The days of an old standalone computer sitting in the corner, disconnected from the internet, are long gone. For your website to be online, it has to be connected all the time.
So one of the first decisions you should make when choosing what sits behind your website is this: what do you actually need, and how regularly will you be able to maintain it?
If you need the features of a full content management system and have someone responsible for maintaining it, WordPress may be an appropriate choice.
But if your website is a handful of pages that rarely change, a full WordPress installation can introduce more complexity, maintenance and risk than you need.
Is there a budget to pay your development or maintenance team to apply updates, test them and deal with anything that breaks? And when a critical vulnerability appears, who is responsible for acting immediately?
A website that looks fine may not be fine underneath
Over the course of yesterday afternoon and overnight, we at Concept Television Studios Limited, including our service brands such as Spawn.London, deployed updates to all our public-facing servers running PHP.
But this morning, other websites will have received no update. The scale of the potential exposure is enormous: Palo Alto Networks reported identifying more than 22.6 million exposed instances potentially vulnerable to these flaws. That is potential exposure, not a count of confirmed compromises.
Leaving a vulnerable system exposed can be like leaving your house with all your family heirlooms inside, your shopfront and your warehouse with their doors wide open, and a giant neon sign saying: “Come in, take what you want and pretend to be us. We’re on holiday.”
And what isn’t being talked about enough is what an attack could actually look like.
We’re not just talking about your server being hit by ransomware and your website being taken offline. Attackers don’t necessarily make obvious changes straight away. They can install a backdoor, giving themselves a way back into your setup.
Then, when you eventually get someone to update PHP, the original vulnerability may be fixed, but that backdoor may still be there. Updating the software does not automatically undo a compromise. The NCSC specifically advises checking for evidence of compromise and attacker-installed backdoors where systems could not be updated or disabled immediately.
Your website could carry on looking perfectly normal. Later, it might start doing strange things: showing unwanted adverts, redirecting visitors to fraudulent pages, or exposing your customers to malicious downloads.
The damage is then being done under your name, using the trust your customers have in your business.
What do you actually need to run your website?
The decision isn’t just about how frequently you pay a maintenance team to update your website. The real choice starts on day one: what do you actually need to drive it?
WordPress has been used time and time again for websites whose content rarely changes. You may not need to log in and change pages regularly. And even when you do, you may end up reaching out to your development company because you’ve forgotten the password, or because an automatic update has broken an old template or plugin.
That is why, with Spawn.London, we have been promoting standard HTML and JavaScript replacement websites.
Where a website does not need PHP or a database, removing those components removes the attack opportunities associated with them. If nothing else on the hosting setup requires PHP, it can be switched off altogether.
That does not make a website immune to every threat. Hosting, access credentials and any connected services still need looking after. But it can substantially reduce the amount of software that needs maintaining.
There are better ways of running many low-maintenance websites: approaches that can be cheaper in the long run and avoid that sudden fear of waking up and asking:
- “Is the hosting company sorting this out?”
- “Will the website company I paid four years ago fix this for me?”
- “Has the company we pay a monthly retainer actually done the update yet?”
- “Does our 48-hour service level agreement mean we’re still vulnerable today?”
The concern is what can happen during that gap. If an attacker gets in before the update is applied, simply applying the update afterwards may not be enough.
Two websites converted overnight
Last night, an external digital agency brought us two websites whose PHP versions were vulnerable. They faced a problem that other businesses may now be discovering: moving to a newer PHP version could break their existing website, its templates or its plugins.
Regular maintenance and compatibility testing help prevent that situation. But the reality for many small businesses is that they commissioned a small website quickly, and the ongoing cost of maintaining WordPress and paying for updated plugins was never properly accounted for.
This is where our HTML replacement websites come in.
Overnight, we were able to take a snapshot of those websites as the public saw them and recreate them using standard HTML, removing the need for PHP and databases. Using simpler, faster technology can also deliver significant improvements in loading speed.
For suitable websites, we can reproduce around 95% of the existing design using our tools and techniques, retaining the appearance your customers recognise while removing the need for those underlying components.
Where interactive features are required, we can advise you on the appropriate way to provide them. An HTML replacement won’t be the right answer for every website, and where you need something more, we can review that and come back to you.
Don’t assume someone else has dealt with it
This article isn’t intended to be a full technical explanation of everything you should do from this point. But whatever you do today, don’t just sit around and wait for this to pan out if your systems may be vulnerable.
Find out who is responsible for your hosting, whether the relevant security fixes have been applied, and what action is being taken if they cannot be applied immediately.
A compromise might leave a hidden backdoor that is used later to attack your customers and damage your reputation. It could also lead to stolen customer data, disruption or ransomware. The extent of the damage depends on the system and the access an attacker obtains, but these are serious possibilities.
We can review your servers and websites and give you a straightforward assessment, without technical jargon, of whether they are exposed to the known vulnerabilities we check, what needs attention and what we recommend. That is a clear assessment of the checks performed, rather than a blanket promise that any website is completely safe.
If you run servers on your premises, or you previously arranged hosting and aren’t sure whether you’re protected, contact us. We are in a position to help.
Get help, and a voucher towards a safer website
We are offering affected businesses a practical rescue opportunity: discount vouchers towards our HTML website conversion service, where conversion is suitable, alongside a discounted rate to move to our hosting solution.
Keep the appearance your customers recognise while removing unnecessary PHP and database dependencies, and the maintenance they bring.
For qualifying charities and organisations supporting good causes, we’re offering larger voucher discounts. Many had a WordPress website put up years ago and have had little reason to change the content since. Unfortunately, not needing to change the content does not mean the software underneath can be left untouched.
We can review the position, explain whether you need one of our services and, where you meet the criteria, offer a substantial discount. Where an HTML replacement isn’t appropriate, we can review your requirements and recommend a suitable approach.
It is important that we pull together at times like this.