Critical security issue affecting PHP

The National Cyber Security Centre (NCSC) is encouraging UK organisations to ensure systems running PHP are updated.

On Wednesday, 21 October 2026 the PHP Foundation released fixes to address two critical vulnerabilities in PHP. Where immediate remediation is not feasible, organisations should consider taking affected systems offline until they can be fully mitigated.

These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now.

Read the full guidance