The PHP project released security fixes on 21 October, and cybersecurity agencies around the world, including the UK’s National Cyber Security Centre (NCSC), have urged organisations to act quickly. This is an industry-wide issue affecting any website that runs on PHP, so merchants should treat it as a priority.
For business owners, the immediate responsibility is straightforward: contact the team responsible for your website and hosting, confirm you’re not running a PHP version at risk, and ensure that the necessary security fixes have been applied.
DNA Payments’ platforms and services remain secure and are operating normally. Our merchants and partners don’t need to take any action regarding our systems. However, your own website’s hosting may need attention.
What has happened?
Two critical vulnerabilities, collectively known as PHP2Shell, have been flagged as at risk in PHP, a software used to run many websites and online stores.
Tracked as CVE-2026-109618 and CVE-2026-109619, both vulnerabilities carry a severity rating of 9.2 out of 10. Under certain conditions, they may allow an attacker to run malicious code on an affected server without logging in. Security updates are available to address both issues.
Because the issue affects the underlying PHP software, updating your website’s content management system, themes, or plugins alone won’t resolve it. Your hosting provider or technical team needs to confirm that PHP itself has been patched.
What this means for DNA Payments customers
Our Merchant Portal, Partner Dashboard and eCommerce payment solutions continue to operate as usual, with payments processed without disruption.
We’ve also contacted our eCommerce merchants directly with recommendations to check and protect their own websites. Our security team continues to monitor developments and will take any further steps needed to protect our platforms.
You can continue using DNA Payments’ services as usual. If your online store uses PHP, please ensure the checks are made below with your hosting provider, IT team or web developer.
What should you do now?
You don't need to manage the technical update yourself, but you should get confirmation from the team that does.
1. Check whether your website uses PHP
Ask your hosting provider, web developer or IT team whether PHP is used anywhere in your website’s hosting environment and whether these vulnerabilities have been addressed.
2. Confirm that the security fixes are installed
The fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Your provider should confirm that your website runs one of these, a later supported release with the fixes, or an equivalent patched package from its vendor.
3. Review older PHP versions
If your website uses PHP 8.1 or earlier, discuss moving to a supported version, and ensure you back up your site before updating. Some providers supply security fixes for older versions, so ask specifically whether their update addresses both PHP2Shell vulnerabilities.
4. Agree the next steps if patching is delayed
Ask your technical team to review the PHP project’s temporary mitigations. These can reduce exposure to particular attack methods, but they don’t replace patching. If updates or temporary mitigations can’t be applied promptly, the NCSC suggests considering taking the affected system, website or platform offline until it can be protected - just to be safe, rather than sorry.
Full technical guidance is available in the PHP security advisory and the NCSC’s security alert.
Frequently asked questions
Do I need to change my DNA Payments integration?
No changes are required to your DNA Payments integration because of this alert. You should still ask your hosting provider to confirm that any PHP used by your own website has been patched.
Another company manages my website. Do I still need to check?
Yes. Ask your website provider to confirm whether your store uses PHP and, if so, whether the relevant fixes have been applied. Having a managed website doesn’t tell you whether a particular security update has been completed.
Who should I contact if I notice something unusual?
Contact your hosting provider or web developer promptly about unusual activity on your website.