Critical PHP security vulnerabilities. What you need to do now, and why it's time to rethink your technology.

On 21 October 2026, the NSA issued an urgent advisory warning organisations about two critical vulnerabilities affecting PHP, one of the world's most widely used programming languages for websites and web applications.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have both been rated critical, with severity scores of 9.2 out of 10.

According to the official PHP security release, these vulnerabilities can allow attackers to execute code remotely without authentication. This could potentially give attackers access to sensitive information or compromise affected systems.

The PHP development team has released security updates for versions 8.2, 8.3, 8.4 and 8.5, and is urging organisations to update immediately.

If your organisation operates a PHP-powered website, application or digital service, the advice is clear.

1. Identify your PHP installations. Understand which websites, applications and services rely on PHP, including systems managed by external vendors.
2. Apply the latest security updates. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, as appropriate. Older versions may require a more substantial upgrade.
3. Monitor your systems. Review logs and security monitoring for signs of suspicious activity, and seek specialist assistance if you suspect a compromise.

The PHP development team has warned that there are no complete workarounds for these vulnerabilities. Updating is the recommended course of action.

For technical guidance, refer directly to the official PHP security announcements and the Australian Cyber Security Centre advisory.

For many organisations, applying a security patch is relatively straightforward. For others, it's a reminder of just how difficult their technology has become to maintain.

Websites and digital products built years ago can accumulate layers of technical debt. Outdated frameworks, unsupported dependencies, custom integrations and poorly documented code can turn what should be a routine update into a complicated and expensive exercise.

This is where the cost of putting off technology modernisation starts to become apparent.

The longer these systems go without meaningful investment, the harder they can become to update, secure and improve. Organisations can find themselves spending more time keeping existing technology operational and less time improving the products and services their customers rely on.

And security is only one part of that equation. Ageing technology can also limit performance, accessibility, scalability and the ability to introduce new capabilities.

There's another reason to take technology modernisation seriously.

AI is changing the capabilities available to both cybersecurity teams and potential attackers. Tools that can help developers identify vulnerabilities, analyse code and improve software quality can also lower the effort required to investigate potential weaknesses.

As these capabilities improve, we should expect organisations to face increasing pressure to identify and address vulnerabilities quickly.

That doesn't mean every AI-enabled attack will be more sophisticated, or that newer technology is inherently secure. But it does mean the ability to maintain and respond to threats is becoming an increasingly important consideration in how we design and engineer digital products.

Security needs to be considered throughout a product's lifecycle, rather than treated as something addressed periodically when a vulnerability makes the news.