The UK’s National Cyber Security Centre (NCSC) is urging organisations to prepare for immediate updates to systems using PHP. PHP powers many websites and online services, including WordPress, Drupal and Joomla, so your organisation may use it without realising. If your website or member portal uses these systems, contact your hosting or software provider urgently to check whether action is required.
The PHP security team has announced fixes for two critical vulnerabilities, both rated 9.2 out of 10 for severity. The release is scheduled for 3pm UK time on 21 October 2026. Details of affected versions and the required updates will be published with the release.
Why acting quickly matters
AI is shortening the time between vulnerabilities being discovered and exploited, according to the NCSC. That means organisations may have very little time to secure affected systems once technical details become public. Although this does not confirm AI is being used against these particular vulnerabilities, it reinforces the need to treat the updates as urgent.
What should you do now?
-
Check your exposure. Ask your website, hosting or software provider whether your systems use PHP and who is responsible for updating it.
-
Prioritise the fixes. Arrange for the appropriate security updates to be applied as soon as they become available.
-
Address any delay. If affected systems cannot be updated promptly, ask your technical provider about temporary protection. CERT-EU advises considering temporarily isolating affected services from the public internet until a fix can be applied.
Need help? VeryConnect can provide practical support.
If you are unsure whether your organisation is affected, do not have a technical person to turn to, or need help addressing the issue, contact us using this form.
Our team can help assess your situation and support the work needed to protect your website and membership services. Get in touch now so we can help you take action.
Further information and updates
Read the Reuters coverage for background on the alert. Check PHP’s official announcements for release details and affected versions. Follow the NCSC security notice for UK guidance.