PHP security flaw: care providers check websites

What the flaw is

PHP is a widely used programming language for websites. The NCSC says the issue involves the way PHP handles running out of memory, which can corrupt memory. In its words, under certain conditions this "could be exploited to achieve unauthenticated remote code execution". In plain terms, an attacker might be able to run their own commands on a web server without logging in.

Two vulnerabilities are listed: CVE-2026-109618 and CVE-2026-109619. The NCSC says organisations using any version of PHP are affected, and that PHP has released a security update that fixes it. Its page does not say whether the flaw has been exploited in the wild.

Why care providers should pay attention

Many care providers have a website, and some are built on WordPress or a similar system that runs on PHP. Some also use online forms for enquiries, referrals or job applications. A compromised website could be used to change pages, capture what people type into forms, or attack visitors.

Digital Care Hub's alert of 22 October 2026 made the point simply: any organisation that runs a website may be affected. It gave two routes:

If an external company manages your website, check they know about the issue, ask them to apply the fix, and make sure they are following NCSC advice.
If you manage your own website and it uses PHP, follow the actions NCSC has published.

What the NCSC recommends

The NCSC's advice for affected organisations is, in summary:

find every system that runs PHP, starting with anything connected to the internet;
update to the latest version of PHP, internet-facing systems first;
if you cannot update straight away, apply the temporary mitigations published by the PHP Foundation;
if that isn't possible, consider taking the system offline;
if you couldn't update or disable it quickly, check for signs of compromise, and get help from an NCSC-assured incident response provider if needed;
keep watching for updates from third-party vendors, because some products and services include PHP inside them.

Where this fits with your wider obligations

The 2026-27 Data Security and Protection Toolkit (DSPT), with a 30 June 2027 deadline, is now open. Keeping systems up to date and managing IT suppliers are part of good data security, and a prompt, recorded response to an alert like this is useful evidence when you complete the toolkit.

If you think personal data may have been exposed through your website, treat it as a potential data breach and follow your incident procedure, including deciding whether it needs reporting.

What this means for your service

Email your website company today. Ask: does our site use PHP, has it been updated for the October 2026 NCSC alert, and when was it done? Keep their reply.
Don't forget other web systems. Online forms, booking tools, staff portals or intranets may also use PHP. Ask each supplier.
If you look after the site yourself, apply the update or ask a competent IT provider to do it. Don't leave it.
Check your website admin accounts. Remove old users and make sure two-step verification is switched on where available.
Record what you did in your IT or data security log. It helps with your DSPT and shows good governance.
No need to panic. A fix exists. The main risk is leaving it unapplied.

Sources

National Cyber Security Centre, Critical security issue affecting PHP (21 Oct 2026, updated 23 Oct 2026): https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php (checked 27 Oct 2026)
Digital Care Hub, Alert: Critical security issue (22 Oct 2026): https://www.digitalcarehub.co.uk/alert-critical-security-issue/ (checked 27 Oct 2026)
NHS England, DSPT news: 2026-27 version 9 (2 Oct 2026; deadline 30 Jun 2027): https://www.dsptoolkit.nhs.uk/News/169 (checked 27 Oct 2026)

How we report: our editorial standards · corrections