Critical PHP Security Vulnerabilities: Could Your Eye Care Practice Be at Risk?

When was the last time you thought about the technology running behind your practice's website?

Most eye care professionals have plenty of other things demanding their attention. Between patient appointments, managing staff, maintaining diagnostic equipment, and keeping the practice running smoothly, website software probably isn't high on the priority list.

If patients can find your practice online, request appointments, and access the information they need, everything seems fine.

But a website or online application can be functioning normally while still having underlying security vulnerabilities.

On October 21, 2026, the UK's National Cyber Security Centre (NCSC) issued an urgent warning about two critical vulnerabilities affecting PHP, a programming language widely used in websites and online applications.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could potentially allow attackers to execute malicious code on vulnerable web servers without needing a username or password.

What Eye Care Practices Need to Know

Here are three important things to understand about this security warning:

The immediate concern is making sure vulnerable systems are identified and updated. But this situation also raises a bigger question: Who is responsible for keeping all the technology your practice depends on secure?

What Is PHP, and Why Would an Eye Care Practice Use It?

PHP is a programming language that helps websites and online applications perform tasks behind the scenes.

For example, your practice's website might allow patients to request appointments, submit questions, or complete contact forms. Depending on how those features were developed, PHP may help process that information.

It's also used in popular website platforms such as WordPress and other web-based applications.

That doesn't mean every patient portal, scheduling platform, or EHR system uses PHP. Different vendors use different technologies, and a specific product shouldn't be considered vulnerable without confirmation.

The important point is that your practice likely relies on technology that your employees never see and don't directly manage.

Your website might be maintained by a marketing agency, your patient communication platform by another vendor, and your EHR by a separate software company.

Each system has its own security requirements and maintenance responsibilities.

Someone needs to know who's keeping those systems protected.

What Happened With These PHP Vulnerabilities?

The vulnerabilities involve problems with how PHP manages computer memory while processing certain requests.

Under certain conditions, these weaknesses could allow an attacker to execute malicious instructions remotely. This is known as remote code execution, and it's a serious category of software vulnerability.

Depending on the server's configuration and permissions, successful exploitation could potentially lead to:

One especially concerning aspect is that exploitation may not require legitimate login credentials.

The PHP development team classified both vulnerabilities as critical and released security updates on October 21, 2026.

The fixed versions include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older, unsupported PHP installations also need attention.

This doesn't mean every website using PHP has been compromised. Successful exploitation depends on several factors, and the existence of a vulnerability doesn't automatically mean an attack occurred.

However, affected systems should be addressed promptly.

Why This Matters to Eye Care Practices

When eye care professionals think about cybersecurity, they often think about protecting patient records, securing their EHR, preventing ransomware, or keeping diagnostic equipment connected.

Those are all important, but they're only part of the picture.

Consider a multi-doctor optometry practice whose website allows patients to submit appointment requests. The website was developed several years ago, and the practice pays a hosting company to keep it online.

Everything works, so nobody has thought much about the software supporting it.

But who is checking for security vulnerabilities?

Or imagine an ophthalmology practice using several online services for patient communication, referrals, forms, and scheduling.

The practice's IT provider manages the office network, but some applications are maintained entirely by outside vendors.

If a critical vulnerability is discovered, who determines whether those systems are affected?

These examples don't mean those systems are vulnerable. They illustrate a common challenge: different technology providers are often responsible for different parts of a practice's operations.

Protecting your practice means looking beyond your EHR and office computers.

Could This Create a HIPAA Concern?

Potentially, depending on the affected system and the information it handles.

Not every website vulnerability creates a HIPAA violation, and discovering vulnerable software doesn't automatically mean patient information has been exposed.

However, systems that create, receive, maintain, or transmit electronic protected health information (ePHI) require particular attention.

Consider the difference between two websites:

Both require appropriate security, but the potential consequences of a compromise can differ significantly.

HIPAA's Security Rule requires covered entities to assess risks to ePHI and implement appropriate safeguards.

That includes understanding relevant risks involving third-party services.

The goal isn't to assume every vulnerability creates a reportable incident. It's to understand what information your systems handle, evaluate potential exposure, and address identified risks.

Who Is Responsible for Keeping Your Technology Secure?

Eye care practices often work with several technology providers, including:

Each provider may control a different part of your environment.

Your IT provider might not have administrative access to your website. Your marketing company may manage website content without maintaining the underlying server. Your software vendor may handle updates within its own infrastructure.

When responsibilities aren't clearly defined, critical updates can be overlooked.

This is why technology documentation and vendor coordination matter.

Your practice should know which systems it uses, who maintains them, and who is responsible for responding when security issues are discovered.

You shouldn't need to become a technology expert to get those answers.

Why Security Updates Can't Always Wait

Software updates aren't always convenient, especially when patients are scheduled throughout the day and staff depend on technology to keep appointments moving.

Some updates are straightforward. Others require testing, vendor coordination, or maintenance outside normal business hours.

But delaying critical updates indefinitely can create unnecessary risk.

For these PHP vulnerabilities, the development team recommends updating affected systems immediately.

When an update can't be applied right away, IT professionals may need to implement temporary protections while preparing for the upgrade.

However, temporary measures don't completely fix these vulnerabilities. Updating to a fixed version remains the recommended solution.

In particularly serious situations, taking an affected system offline until it can be secured may be necessary.

The objective should always be to address security risks promptly while minimizing disruption to patient care.

Five Questions Every Eye Care Practice Should Ask Its Technology Providers

You don't need to know how to update PHP or configure a web server yourself.

But you should feel confident that someone is evaluating security threats that could affect your practice.

Here are five questions worth asking:

1. Are any of our websites or online applications affected? Determine whether PHP is being used and whether any installations require security updates. 2. Who is responsible for securing our patient-facing technology? Clarify responsibilities among your IT provider, website developer, hosting company, and application vendors. 3. Have the necessary security updates been applied? If affected software is identified, confirm that updates have been completed and verified. 4. Are we running outdated or unsupported software? Older systems may no longer receive security updates and could require replacement or migration. 5. What happens when a critical vulnerability is discovered? Your practice should have a process for identifying alerts, evaluating risks, coordinating updates, and investigating potential security incidents.

You don't necessarily need detailed technical reports for every update. But you should know that a reliable process exists and that someone is taking responsibility for following through.

The Bigger Lesson for Eye Care Practices

These PHP vulnerabilities are another reminder that cybersecurity isn't something you set up once and forget.

Technology changes. New weaknesses are discovered. Software becomes outdated. Practices adopt new applications and services, often without fully considering how they'll be maintained.

Even technology that was secure when installed can develop new risks over time.

Being prepared means understanding which systems your practice depends on, knowing who maintains them, and having a plan when something needs attention.

At IT4Eyes, we believe technology should support patient care, not create unnecessary uncertainty or disruption. That includes helping practices understand technology risks, coordinate with vendors, and maintain the systems they rely on.

If you're unsure whether your practice has a reliable process for identifying and managing cybersecurity vulnerabilities, a cybersecurity risk assessment can help uncover potential gaps and identify areas for improvement.

Because protecting your practice isn't just about responding when something breaks. It's about recognizing potential problems before they affect your patients, your staff, or your ability to deliver care.

Sources and Further Reading