As you may well have heard in news headlines – two worldwide critical security vulnerabilities were discovered and released yesterday, 21 October, 2026.
These vulnerabilities lie within a programming language called PHP, which is a language used widely for websites.
If you or your organisation has a website, it’s extremely likely it will have been affected. Most platforms, such as WordPress, use PHP.
The flaw is extremely dangerous, as it could allow attackers to take control of any affected web servers. Unauthenticated attackers can run malicious code, crash servers and steal sensitive data.
There are already a large number of attacks underway and the threat requires immediate action.
As a matter of urgency, ensure your website is updated to the latest version of PHP – these are the patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The NCSC advise taking sites offline until this is undertaken.
If you host your own server, you will be able to update PHP from the command line. If you are using a hosting service, you will find a setting in the hosting management console which will allow you to update.
If your website was not previously running the latest version, it’s likely that some features will fail to function correctly following the update. In this instance you may need to update your framework and plugins. If you have a website designer that looks after this for you, we would suggest you contact them urgently to ensure this is complete.
If you have a website hosted by us, we will already have sent you a work request ticket. Please respond promptly with permissions and we will complete the updates for you.
There is also more information available at: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
If you have any concerns please get in touch.
You can reach us on 01223 903 800, [email protected], raise a ticket, or book a time for a call online at: https://calendly.com/hello-gsl/mtg-25min.