23 October 2026 · Updated 26 October 2026 · Website Security
This week, websites across Europe suddenly went offline. Government services, online retailers and news organisations were among those affected. Many had been taken offline deliberately while emergency security fixes were being applied.
The cause was the discovery of two critical vulnerabilities in PHP, one of the most widely used technologies behind the internet. The issue was serious enough for national cybersecurity agencies to urge organisations to update their systems immediately, or consider taking vulnerable websites offline until they could be secured.
As reported by The Irish Times and The Journal, the disruption has affected websites and online services around the world, including in Ireland.
What exactly happened?
PHP is the programming language that handles much of the work behind a website: processing forms, accessing databases, managing user accounts and running online shops or booking systems.
It's used by an estimated 70% of websites worldwide, including those built with WordPress and many other popular platforms.
On 21 October, PHP's developers released emergency fixes for two newly disclosed vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Both received a critical severity rating of 9.2 out of 10.
Under certain conditions, these flaws could allow an attacker to execute code on a vulnerable web server without needing a username or password.
Depending on the website, a successful attack could expose sensitive information such as customer contact details, account records or purchase histories. Attackers could also alter website content, install malicious software or gain control over parts of the system.
The UK's National Cyber Security Centre (NCSC) has issued an urgent warning, advising organisations to identify potentially affected systems and apply the necessary security updates.
How do you know if your website is affected?
This is where things become less straightforward for business owners.
A website can appear to be working perfectly normally while still running vulnerable software. There may be no visible errors, suspicious messages or obvious changes to how the site behaves.
Routine website updates alone do not establish whether the underlying server is protected. A security audit examines the PHP installation, its configuration and the security fixes applied to it.
Checking a version number is not enough. The precise software build and any security fixes incorporated into it need to be assessed as part of that review.
The NCSC specifically recommends examining all PHP installations exposed to the internet, not just those running obviously outdated versions.
A security audit checks the underlying setup and provides a clear account of whether the relevant protections are in place.
Be cautious with online PHP scanners
Be cautious of online tools promising to confirm a website is safe from the PHP vulnerabilities simply by scanning its address. An external scan can highlight warning signs, but a clean result does not by itself prove that the relevant fixes have been installed.
These checks may rely on information exposed by the website, such as a reported PHP version. That information can be hidden or misleading, and hosting vendors may apply security fixes without changing the headline version number. A public scanner’s “safe” badge should never replace verification with the server or hosting provider.
Use a provider you trust. Don’t give an unfamiliar scanner hosting passwords, install its software or pay for urgent repairs solely on the strength of an instant result.
What should business owners do?
Arrange a security audit to establish whether your website uses affected PHP software, confirm that the relevant security fixes are in place and identify any remaining exposure.
Where changes are necessary, it's also important to check that the website continues to function correctly afterwards. Contact forms, customer accounts, online payments and booking systems all need to be considered.
For businesses without someone looking after the technical side of their website, knowing where to begin can be difficult.
Website Security Audit & Protection — DIAGA
At DIAGA, we've spent more than a decade developing websites and online systems for businesses and organisations. Our experience in web development and systems security means we can investigate the underlying technical setup, not just what visitors see on screen.
In response to the newly disclosed PHP vulnerabilities, we're offering a one-off Website Security Audit & Protection Service.
How DIAGA verifies the findings
Our audit combines professional security checks with a review of the actual hosting environment. We establish which PHP build is serving the website, check installed security fixes and relevant configuration against PHP’s published security guidance and hosting-vendor advisories, and account for vendor-supplied fixes that a simple version check may miss.
Where we have authorised server access, we verify those details directly; on managed hosting, we work with the provider to obtain the relevant evidence. We then carry out or coordinate agreed fixes and test the site’s key functions. Your report sets out what was checked, the evidence supporting the findings, any work completed and any remaining limitations or recommendations.
What's included:
Security audit — Check your website and underlying systems for exposure to the recently disclosed PHP vulnerabilities.
Security updates — Carry out or coordinate any necessary security fixes and updates.
Verification — Confirm the relevant fixes have been applied and test the website's essential functions afterwards.
Security report — Provide a clear summary of what we found, what was done and any remaining recommendations.
One-off security audit & protection: €199 ex VAT.
We’ll confirm the scope before work begins and discuss any additional work or hosting charges separately.
The aim is straightforward: establish whether your website is affected, address any problems identified and give you a clear account of its security status in relation to these vulnerabilities.
Not sure whether your website is protected?
Get in touch with DIAGA to arrange a Website Security Audit & Protection review.
