22 October 2026
Bira is urging businesses of all sizes to check their websites are protected, following a warning about a critical security flaw affecting PHP.
Bira has alerted its members and other small businesses to the risk and is advising them to speak to their web developer or hosting provider as a priority.
Andrew Goodacre, CEO of Bira, said: “This is a serious warning and one that independent retailers should not ignore. Many small shops now rely on their website to take orders, show stock and stay in touch with customers, and a large number of those sites run on PHP without the owner ever knowing it. We have said many times that no business is too small to be targeted by cyber criminals, and that is very much the case here.“You do not need to be a technical expert to protect your business. Simply contact whoever built or hosts your website and ask them to confirm that PHP has been updated to the latest fixed version. If your site is running an older version that is no longer supported, now is the time to get it upgraded. It is a quick conversation that could save a great deal of trouble.”
PHP is the technology behind a large share of the world’s websites, including many built on popular platforms such as WordPress and WooCommerce. The PHP Foundation issued an advisory this week warning of two serious vulnerabilities, and fixes are now available. The National Cyber Security Centre (NCSC) is encouraging UK organisations to take immediate action, warning that the flaws may allow attackers to run commands on any web server running PHP.
According to the PHP Foundation, the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older versions no longer receive security updates, so businesses running these are being urged to move to a supported version. The NCSC advises that all versions may be affected and that organisations should not assume they are safe simply because they are running a recent version.
Bira explored the issue earlier this year in an episode of its High Street Matters podcast, No Business Too Small - Protecting Independent Retailers from Cyber Crime. The episode featured Mr Goodacre alongside retail technology expert Melissa Minkow of CI&T and Bira member Andrew Maben of Kevin’s Schoolwear, who shared his own experience of a cyber attack. To listen, search ‘High Street Matters Bira’ on your podcast provider of choice.
Retailers can also find practical advice on protecting their business online on the cyber security resource page.
Further guidance is available on the NCSC website.
Bira work with the Cyber Resilience Centres (CRC)
Bira have partnered up with the Cyber Resilience Centres and their network of centres across England and Wales, established to strengthen the cyber resilience and cyber security of small/medium enterprises throughout England & Wales.
Find out more at our Cyber Security Hub.
Image credit: ภัทรชัย รัตนชัยวงค์/stock.adobe.com
Latest News
-
Cost crisis looms for independent retailers ahead of Budget
Independent retailers face a looming cost crisis unless the Chancellor acts in the Budget, Bira has warned.
-
Marketplace VAT crackdown risks creating new loopholes, independent retailers warn
Bira has welcomed plans to make online marketplaces collect VAT but warns that proposed exemptions could undermine the crackdown.
-
Sellers of castor beans and rosary peas could face licence-only sales under new proposals
Sellers of castor beans and rosary peas would only be allowed to sell them to individuals with a valid licence.
-
New banknotes to bring updated security features for retailers
The Bank of England has confirmed that the next series of banknotes will feature an Atlantic puffin, barn owl, buff-tailed bumblebee and European hedgehog.