Critical PHP Security Vulnerability (Website security)

Posted on October 22nd, 2026

We wanted to reassure our patients that the 2 public-facing web facilities that we use have both assured us that they have mitigated any risks posed by the PHP vulnerabilities that have appeared in the media today (22 October 2026). Link

Surgery Web (Hosts for this website) responded as follows;

Important: PHP Critical Vulnerability

You may have seen recent alerts, including notifications from NHS cyber security teams, about two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

We would like to reassure you that our hosting provider has applied the required security updates, and all websites we host are now running PHP 8.4.27, which includes fixes for both vulnerabilities.

This is a global issue involving PHP—the technology that helps websites process requests and display content. PHP powers around 70% of websites whose underlying server technology is known, including websites built with WordPress. This issue therefore has implications for website owners and hosting providers worldwide.

In basic terms, these vulnerabilities could allow an attacker to run unauthorised instructions on an unpatched server. They affect the underlying PHP software, rather than being a fault specific to your website or WordPress. Installing the security update addresses these vulnerabilities.

Our hosting provider has been proactive since the security update was announced, and patching is now complete across our hosted websites. No action is required from you in relation to this update.

Thank you to everyone who contacted us or forwarded security notifications. We appreciate your concern and diligence. We actively monitor security advisories and work closely with our hosting provider to respond promptly, without waiting for customer notifications.

The security of your website and its data remains a priority.

AccuRx (Hosts for our online triage form) responded as follows;

You may have seen NHS England’s recent cyber alert (CC-4875) about two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities could allow an attacker to run malicious code or access sensitive data on systems running affected versions of PHP.

We’ve reviewed the advisory and can confirm that Accurx is not affected. Our platform does not use PHP, so these vulnerabilities do not apply to any of our products or services.

You don’t need to take any action on your end in relation to Accurx. If you have questions about your own organisation’s systems, we’d recommend following NHS England’s guidance and speaking to your IT or cyber security team.

As always, if you have any questions, our support team is here to help.