Critical website security flaw - all retailers urged to act now

Posted on 22 Oct 2026

Bira is urging businesses of all sizes to check their websites are protected, following a warning about a critical security flaw affecting PHP.

Bira has alerted its members and other small businesses to the risk and is advising them to speak to their web developer or hosting provider as a priority.

Andrew Goodacre, CEO of Bira, said: “This is a serious warning and one that independent retailers should not ignore. Many small shops now rely on their website to take orders, show stock and stay in touch with customers, and a large number of those sites run on PHP without the owner ever knowing it. We have said many times that no business is too small to be targeted by cyber criminals, and that is very much the case here.

“You do not need to be a technical expert to protect your business. Simply contact whoever built or hosts your website and ask them to confirm that PHP has been updated to the latest fixed version. If your site is running an older version that is no longer supported, now is the time to get it upgraded. It is a quick conversation that could save a great deal of trouble.”

PHP is the technology behind a large share of the world’s websites, including many built on popular platforms such as WordPress and WooCommerce. The PHP Foundation issued an advisory this week warning of two serious vulnerabilities, and fixes are now available. The National Cyber Security Centre (NCSC) is encouraging UK organisations to take immediate action, warning that the flaws may allow attackers to run commands on any web server running PHP.

According to the PHP Foundation, the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older versions no longer receive security updates, so businesses running these are being urged to move to a supported version. The NCSC advises that all versions may be affected and that organisations should not assume they are safe simply because they are running a recent version.

Bira explored the issue earlier this year in an episode of its High Street Matters podcast, No Business Too Small - Protecting Independent Retailers from Cyber Crime. The episode featured Mr Goodacre alongside retail technology expert Melissa Minkow of CI&T and Bira member Andrew Maben of Kevin’s Schoolwear, who shared his own experience of a cyber attack. To listen, search ‘High Street Matters Bira’ on your podcast provider of choice.

Retailers can also find practical advice on protecting their business online on the cyber security resource page.

Further guidance is available on the NCSC website.