_edited.png)
Critical PHP Security Vulnerabilities: Why Patching Your Website Is Only the First Step
Organisations running PHP websites and web applications should prioritise security updates following an alert from the National Cyber Security Centre (NCSC) about two critical vulnerabilities affecting PHP. Once the necessary updates have been applied, businesses should also consider whether their wider web application security needs independent testing.
PHP is one of the most widely used programming languages for building websites and web applications. It underpins platforms including WordPress, Drupal, Joomla and Magento, alongside countless bespoke applications and e-commerce systems.
On 21 October 2026, the NCSC issued an alert urging UK organisations to prepare for immediate updates to systems running PHP. The warning follows the announcement of two critical vulnerabilities, both rated 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS v4.0). The PHP security team has advised users to apply the relevant updates as soon as they become available.
The NCSC has also advised organisations to identify their PHP systems, monitor internet-facing applications for malicious activity and consider taking systems offline where immediate remediation is not possible. Read the NCSC's full alert.
For businesses that rely on their websites and web applications to deliver services, process transactions or store customer information, this is a timely reminder of the importance of proactive security testing.
Why Are PHP Vulnerabilities a Concern?
PHP handles server-side operations, including processing user input, interacting with databases, managing sessions and generating dynamic web pages. Vulnerabilities in the underlying PHP environment can therefore have implications beyond the website's visible content.
Depending on the vulnerability and the affected environment, an attacker may be able to exploit a weakness to compromise an application or its supporting infrastructure.
The potential consequences of a successful attack can include:
Data breaches: Unauthorised access to customer information, business records or other sensitive data.
Website compromise: Unauthorised changes to website content or the introduction of malicious code.
Service disruption: Attacks that affect website availability or interfere with business operations.
Further compromise: Access to an application or server that could provide a route to other systems, depending on the permissions and network configuration in place.
The precise impact of any vulnerability depends on the affected PHP version, application configuration and surrounding security controls. Organisations should follow the official PHP security guidance to establish whether their systems are affected and which updates are required.
However, the immediate priority is clear: identify affected systems and apply the appropriate security updates as soon as practicable.
Step One: Identify and Patch Your PHP Systems
Before considering further security testing, organisations should establish which systems use PHP and ensure that responsibility for updating them is clearly assigned.
This can be more complicated than it first appears. PHP may be running on a dedicated web server, within a hosting environment, or as part of a content management system or third-party product. A website owner may also rely on a hosting provider or external developer to maintain the underlying technology.
Organisations should:
Identify PHP installations. Establish which websites, web applications, servers and third-party products use PHP, prioritising systems accessible from the internet.
Check the affected versions. Consult the official PHP security announcements and relevant vendor guidance to determine whether systems require updating.
Apply security updates promptly. Arrange the necessary updates and verify that they have been applied successfully. Where a third party manages the environment, confirm who is responsible for remediation.
Review monitoring and logs. Look for suspicious activity involving internet-facing PHP systems, particularly where a vulnerable system may have been exposed.
Investigate potential compromise. If there are indications that a system was attacked, do not assume that applying a patch is sufficient. Investigate the activity and establish whether further incident response is required.
Patching is essential, but it addresses known vulnerabilities. It does not establish whether the application contains other security weaknesses.
Step Two: Assess Your Wider Web Application Security
Once the relevant updates have been applied and the immediate risk has been addressed, businesses should consider whether their web applications would benefit from an independent security assessment.
A web application penetration test involves authorised security testing designed to identify and validate vulnerabilities that could be exploited by an attacker.
Rather than looking exclusively at the underlying PHP version, a penetration test examines the security of the application itself, its functionality and the ways in which users interact with it.
Depending on the scope of the engagement, testing may examine areas such as:
Authentication and Access Controls
Weak authentication mechanisms or inadequate access controls can allow users to access accounts, information or functionality beyond their intended permissions.
Testing can assess whether these controls work as expected and whether an attacker could bypass them.
Input Validation and Injection Vulnerabilities
Web applications frequently process information submitted through forms, search functions, API requests and other user interactions.
Insufficient validation or unsafe handling of this information can introduce vulnerabilities, including SQL injection and cross-site scripting (XSS). Testing can help identify weaknesses in how the application processes and handles untrusted input.
Session Management
Applications use sessions to maintain authenticated user access. Inadequate session management can create opportunities for attackers to interfere with sessions or gain unauthorised access to accounts.
Business Logic Vulnerabilities
Not every vulnerability results from a technical flaw in the underlying platform. Some arise from the way an application has been designed.
For example, an attacker may be able to manipulate a transaction, bypass a required workflow, access another customer's records or perform an action that should be restricted.
These issues can be difficult to identify through automated vulnerability scanning alone and may require manual investigation by an experienced penetration tester.
Server and Application Configuration
Testing can also help identify security weaknesses associated with application configuration, exposed functionality, error handling and the information disclosed by the application.
The precise checks performed will depend on the application's architecture, functionality and agreed testing scope.
Why Consider a Penetration Test After Patching?
A security update should not be confused with a complete security assessment.
Even where a PHP vulnerability has been successfully remediated, the application may still contain weaknesses introduced through its own code, third-party components, configuration or access controls.
For example, updating PHP will not automatically correct an insecure password reset process, a broken authorisation mechanism or an API that exposes information to unauthorised users.
A web application penetration test provides an opportunity to investigate these wider risks and understand how they might be exploited.
It can also help organisations prioritise remediation by providing technical evidence of identified vulnerabilities, their potential impact and recommendations for addressing them.
For businesses that depend on their websites to support customers, generate revenue or process sensitive information, this can provide valuable insight into their overall security posture.
The recommended approach is to patch first, investigate any indications of compromise, and then consider independent penetration testing to assess the application's wider security.
A penetration test is not a substitute for applying security updates, nor does it guarantee that an application is free from vulnerabilities.
Does Your Business Run PHP?
If your business operates a PHP-based website or web application, the current security alert is a useful opportunity to review your approach to vulnerability management.
You should establish whether your systems are affected, confirm that the necessary updates have been applied and consider when your application was last subjected to independent security testing.
This is particularly relevant for businesses operating customer portals, e-commerce platforms, bespoke web applications or systems that process sensitive information.
Even if your website is maintained by an external developer or hosting provider, you should understand who is responsible for security updates and how the security of the application itself is assessed.
If you have not arranged a web application penetration test recently, an independent assessment can help identify vulnerabilities that may otherwise remain undetected.
Web Application Penetration Testing from Delta Cyber Security
Delta Cyber Security provides web application penetration testing to help organisations identify security vulnerabilities, understand their potential impact and take informed steps to reduce risk.
Our testing combines technical investigation with manual assessment to examine how an application behaves under attempted attack. Findings are documented in a report that explains the identified vulnerabilities, their significance and recommended remediation measures.
Whether you operate a customer facing website, an e-commerce platform or a bespoke web application, we can discuss your requirements and recommend an appropriate testing scope.
Contact Delta Cyber Security to discuss web application penetration testing for your business.
Visit our website to learn more about our penetration testing services or arrange a scoping call to discuss your application and security requirements.
