A newly disclosed security issue affecting PHP, one of the most widely used technologies behind websites, has prompted an urgent warning from the UK’s National Cyber Security Centre.
For amateur organisations, clubs, charities and community groups, the important point is simple:
Your website may use PHP even if you have never knowingly installed or managed it.
Popular website platforms including WordPress, Joomla and Drupal commonly rely on PHP behind the scenes.
The current vulnerabilities are considered critical because, in some server configurations, they could allow an attacker to execute code remotely on a vulnerable system.
The good news is that fixes are now available.
The important thing is to make sure they have actually been applied.
WordPress users: updating WordPress is not enough
If your organisation runs a WordPress website, this is particularly important.
The vulnerability is not a WordPress vulnerability. It exists in PHP, the software running underneath WordPress.
That means updating WordPress, themes and plugins does not by itself resolve this particular issue.
WordPress has advised site owners to check which version of PHP their website is using and to ensure their hosting provider has applied the appropriate security update.
You can normally find your PHP version in WordPress by going to:
Tools → Site Health → Info → Server
Your hosting provider's control panel may also show it.
Which PHP versions contain the fix?
The patched versions are:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
If your website is running an earlier version within one of these branches, it should be updated.
Older PHP versions that are no longer supported present an additional problem and should be migrated to a currently maintained version.
What should a small organisation actually do?
For most volunteer-run organisations, the answer is not to start changing server settings yourself.
Instead, contact whoever provides or manages your website hosting and ask:
Can you confirm that our website hosting has been patched against the current critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and tell us which version of PHP our website is running?
If your website is looked after by a developer, webmaster or volunteer, send the same question to them.
The UK National Cyber Security Centre has advised organisations to identify internet-facing systems running PHP and apply updates as soon as possible. Where systems cannot be properly protected, it has even advised organisations to consider taking them offline temporarily.
That may sound dramatic, but the potential consequences of a compromised website can be significant.
Why this matters to amateur organisations
A community website may appear fairly harmless.
But behind it there may be:
membership information
contact details
email addresses
booking information
mailing lists
payment systems
administrator passwords
safeguarding information
personal information submitted through forms
A compromised homepage is inconvenient.
A compromised system containing personal information is much more serious.
What about Wix, Squarespace and similar services?
If your website is built using a fully managed service such as Wix, Squarespace or Shopify, the underlying server software is normally managed by the provider.
You therefore would not usually be responsible for updating PHP yourself.
With conventionally hosted WordPress, Joomla, Drupal or bespoke PHP websites, however, it is important to establish whether PHP updates are being handled automatically by your host or whether somebody within your organisation is expected to manage them.
There is a wider lesson here
This particular PHP issue will be patched and eventually disappear from the headlines.
For many voluntary organisations, however, it exposes a much more persistent problem.
Websites are often created by a helpful volunteer, committee member or friend who understands the technology. Several years later that person may have moved on, while nobody remaining knows exactly how the website works.
That can leave organisations with:
old plugins and themes
unsupported software
forgotten administrator accounts
weak passwords
no reliable backups
hosting accounts nobody actively monitors
no clear responsibility for website security
This incident is therefore a useful opportunity to carry out a simple website health check.
Every organisation should know:
who owns the domain name
who controls the hosting account
who has administrator access
whether multi-factor authentication is available
whether the website is backed up
where those backups are stored
who is responsible for software updates
whether former volunteers still have access
what personal information the website stores
None of this requires an organisation to employ a cybersecurity department.
It simply requires somebody to be responsible.
Our advice
If you run a website for a brass band, music group, club, charity or other voluntary organisation:
Don't panic. Don't install random security software. Don't assume that updating WordPress has solved the problem.
Instead:
Contact your hosting provider, establish which version of PHP you are running and confirm that the latest security updates have been applied.
A ten-minute check today could prevent a much more difficult problem later.
