- Published
- Source
- NCSC Official
- Filed under
- UK Gov & NCSC
- Length
- 179 words, in full
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
The release is scheduled for Wednesday, 21 October 2026 at 15:00 BST, but may occur earlier. This page will also be updated.
Organisations should:
- Identify systems running any version of PHP across your infrastructure, prioritising internet-facing systems
- Perform monitoring of internet-facing PHP systems for malicious activity
- Monitor the PHP official guidance
- Apply PHP updates as they become available
- Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP
Background
On 20 October 2026, the PHP Foundation announced an upcoming security release addressing two critical vulnerabilities in PHP.
PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user’s browser. PHP is also used in a range of other products.
Contains public sector information licensed under the Open Government Licence v3.0. Open Government Licence v3.0 · Published by NCSC.
MyCyberWay training
Blue Team Analyst
Every story here started as an alert. Learn to triage them.
Our Blue Team Analyst programme prepares you for a first SOC role: 26 live classes in UK hours, an alert queue worked in Microsoft Sentinel, and a full SOC shift simulation at the end. No security experience needed to start.
- Triage and KQL in Microsoft Sentinel
- Identity, endpoint, email and network investigations
- A verifiable digital badge
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
