23 October 2026 · Website Security
This week, websites across Europe suddenly went offline. Government services, online retailers and news organisations were among those affected. Many had been taken offline deliberately while emergency security fixes were being applied.
The cause was the discovery of two critical vulnerabilities in PHP, one of the most widely used technologies behind the internet. The issue was serious enough for national cybersecurity agencies to urge organisations to update their systems immediately, or consider taking vulnerable websites offline until they could be secured.
As reported by The Irish Times and The Journal, the disruption has affected websites and online services around the world, including in Ireland.
What exactly happened?
PHP is the programming language that handles much of the work behind a website: processing forms, accessing databases, managing user accounts and running online shops or booking systems.
It's used by an estimated 70% of websites worldwide, including those built with WordPress and many other popular platforms.
On 21 October, PHP's developers released emergency fixes for two newly disclosed vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Both received a critical severity rating of 9.2 out of 10.
Under certain conditions, these flaws could allow an attacker to execute code on a vulnerable web server without needing a username or password.
Depending on the website, a successful attack could expose sensitive information such as customer contact details, account records or purchase histories. Attackers could also alter website content, install malicious software or gain control over parts of the system.
The UK's National Cyber Security Centre (NCSC) has issued an urgent warning, advising organisations to identify potentially affected systems and apply the necessary security updates.
How do you know if your website is affected?
This is where things become less straightforward for business owners.
A website can appear to be working perfectly normally while still running vulnerable software. There may be no visible errors, suspicious messages or obvious changes to how the site behaves.
Routine website updates alone do not establish whether the underlying server is protected. A security audit examines the PHP installation, its configuration and the security fixes applied to it.
Checking a version number is not enough. The precise software build and any security fixes incorporated into it need to be assessed as part of that review.
The NCSC specifically recommends examining all PHP installations exposed to the internet, not just those running obviously outdated versions.
A security audit checks the underlying setup and provides a clear account of whether the relevant protections are in place.
What should business owners do?
Arrange a security audit to establish whether your website uses affected PHP software, confirm that the relevant security fixes are in place and identify any remaining exposure.
Where changes are necessary, it's also important to check that the website continues to function correctly afterwards. Contact forms, customer accounts, online payments and booking systems all need to be considered.
For businesses without someone looking after the technical side of their website, knowing where to begin can be difficult.
Website Security Audit & Protection — DIAGA
At DIAGA, we've spent more than a decade developing websites and online systems for businesses and organisations. Our experience in web development and systems security means we can investigate the underlying technical setup, not just what visitors see on screen.
In response to the newly disclosed PHP vulnerabilities, we're offering a one-off Website Security Audit & Protection Service.
What's included:
Security audit — Check your website and underlying systems for exposure to the recently disclosed PHP vulnerabilities.
Security updates — Carry out or coordinate any necessary security fixes and updates.
Verification — Confirm the relevant fixes have been applied and test the website's essential functions afterwards.
Security report — Provide a clear summary of what we found, what was done and any remaining recommendations.
The aim is straightforward: establish whether your website is affected, address any problems identified and give you a clear account of its security status in relation to these vulnerabilities.
Not sure whether your website is protected?
Get in touch with DIAGA to arrange a Website Security Audit & Protection review.