Two critical PHP vulnerabilities, both rated 9.2 out of 10, were patched on 21 October 2026. Here is what New Zealand businesses should ask their website provider, and where Layer3’s responsibilities start and stop.
Security
Two critical security vulnerabilities have been discovered in PHP, software that powers millions of websites worldwide. Emergency security updates were released on 21 October 2026, with website operators and hosting providers urged to take immediate action.
For New Zealand businesses, the key question is whether their website is affected and whether their website provider has applied the necessary updates.
The PHP development team identified two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity.
These vulnerabilities could potentially allow attackers to remotely execute malicious code on affected web servers without needing to log in.
PHP is commonly used by websites built on platforms such as WordPress, online stores and other content management systems. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Using PHP does not automatically mean your website has been compromised. However, websites running vulnerable versions may be exposed until the appropriate security updates are applied.
The vulnerabilities have attracted international attention, with reports of some websites being temporarily taken offline as a precaution while security updates are applied.
As highlighted in recent Stuff NZ reporting, artificial intelligence also played a role in discovering these security weaknesses.
This highlights how quickly cybersecurity is evolving. AI is helping security researchers identify vulnerabilities, but it can also help attackers find weaknesses faster.
For businesses, it reinforces the importance of keeping software updated and ensuring someone is responsible for maintaining the security of every system.
If your organisation has a website or online application, we recommend contacting your website developer or hosting provider and confirming:
For most businesses, these checks and updates should be handled by their website or hosting provider.
Layer3 does not build, host or maintain websites. We manage computers, networks, Microsoft 365, cloud infrastructure and cybersecurity, and none of the platforms we use to deliver those services rely on PHP. Layer3-managed environments are not affected by these vulnerabilities.
We continue to monitor security vulnerabilities and assess their relevance to the systems and services we manage.
If your website is managed by an external developer or hosting provider, they are responsible for assessing these PHP vulnerabilities and applying the necessary updates.
If you are uncertain who manages your website, now is a good opportunity to clarify those responsibilities.
These PHP vulnerabilities are serious, but they do not automatically mean your business has been compromised.
The necessary security patches are now available, and website providers should be taking appropriate action.
Our recommendation is simple: contact your website provider, confirm whether your website is affected, and ask for confirmation that the required security updates have been applied.
If you have concerns about the security of your Layer3-managed IT environment, our team is available to assist.
Keep reading
Next step
Most organisations do not have an IT problem. They have an accountability problem. We fix that first, then the technology gets easy.
Our services
Layer3 is a managed IT provider operating an ISO/IEC 27001-certified ISMS, with offices across New Zealand.
Contact
0508 LAYER3 Book a discovery call Service status Notices
Level 2, CBD Towers
84-90 Main Street
Upper Hutt, Wellington 5018
© 2026 Copyright Layer3.
Layer3
Book a discovery call - 30 minutes, no obligation
