The National Cyber Security Centre (NCSC) has issued a critical security alert relating to vulnerabilities affecting PHP, a technology widely used across websites, web applications and other products.
Organisations using PHP are being urged to review their systems, understand where they may be exposed and prepare to apply the relevant security updates.
While this may not directly affect your organisation, PHP is widely used across websites, web applications and other services. Below, we explain what the alert means, what organisations should be checking and the recommended steps you can take to reduce your risk.
Why does this matter?
The NCSC is advising UK organisations to act now rather than waiting for the security release to become available. In particular, organisations should identify systems running any version of PHP, with internet-facing services receiving the highest priority.
The potential exposure is not limited to applications that your organisation has developed itself. The NCSC also recommends monitoring security updates from third-party software vendors, as applications and other services may use PHP as a component.
What should organisations do now?
Based on the NCSC guidance, we recommend customers take the following steps:
1. Identify where PHP is being used
Speak to your website developers and application providers, and review your wider infrastructure for systems running any version of PHP. Prioritise systems that are accessible from the internet.
Netcentrix has reviewed our monitored server estate and, where we have identified any affected customers, we have already made direct contact to support them with the required action.
2. Check third-party applications and appliances
PHP may also be used within third-party products and services. Review relevant vendor advisories and monitor suppliers for security updates.
Netcentrix has also contacted our vendors and will proactively update any affected appliances where required.
3. Increase monitoring of internet-facing systems
The NCSC recommends monitoring internet-facing PHP systems for signs of malicious activity.
4. Be prepared to patch as soon as updates become available
The PHP security release is currently scheduled for 15:00 BST on 21 October 2026, although the NCSC notes that it may be released earlier. Organisations should monitor the official PHP guidance and apply appropriate security updates as they become available.
5. Consider isolating systems that cannot be remediated
Where immediate remediation is not feasible, the NCSC advises organisations to consider taking the affected system offline until it can be fully mitigated.
For the latest information and guidance, please refer to the National Cyber Security Centre’s Critical security issue affecting PHP.
Strengthen your cyber security
Security vulnerabilities like this are a reminder of how quickly the threat landscape can change. If you’d like to understand how well protected your organisation is, our N-Force cyber security services can help you identify risk and strengthen your security posture.
Call us on 0333 003 0560 or complete our contact form and we will be in touch.
