October 22nd 2026
As you may be aware from heightened media coverage, security researchers have discovered vulnerabilities in the widely used scripting language PHP. There are a number of products that integrate PHP into their services, such as WordPress, Drupal and Joomla.
If your organisation operates a website, then you may be affected.
Where your website is managed by an external IT provider then you should check whether they are aware of the vulnerability and push for them to remediate and follow the advice issued by the NCSC.
If you manage your own website and use PHP, then NCSC have published actions you should be taking where you are affected – Critical security issue affecting PHP | National Cyber Security Centre
Further detail can also be found on NHS England’s website – Critical Vulnerabilities in PHP (PHP2Shell) – NHS England Digital
View all News