Earlier this month, the National Cyber Security Centre (NCSC) flagged two critical vulnerabilities in PHP, the software that runs most websites, including the majority of ours. We wanted to give our clients a clear update on what we’ve done about it.
What the issue was
The vulnerabilities could, in theory, let an attacker interfere with a website’s server. PHP’s maintainers released official fixes for current, supported versions of PHP on 21 October 2026.
What we’ve done
We checked every server we manage against the official fix, rather than relying on dashboard status indicators, which in some cases showed as “patched” when the underlying software hadn’t actually changed.
Where an official fix exists, it’s now applied across our infrastructure.
Some of our servers run older versions of PHP that are no longer supported by its maintainers, generally because the websites on them are legacy systems that can’t be upgraded without extensive rework, or because doing so would mean taking active client sites offline. For these, no official fix exists at all — so we’ve applied a set of server-level configuration changes that close off the specific way this vulnerability could be exploited, without needing to touch the sites themselves or take anything offline.
What this means for you
No action is needed on your part, and no sites have gone offline. The one small side effect: on the small number of forms that show a live progress bar while a file uploads, that bar may no longer update — the upload itself still completes as normal. Everything else about how your website works is unchanged. If your site runs on an unsupported version of PHP, we’d still recommend planning an upgrade when convenient, and we’re happy to talk through what that would involve.
As always, if you have any questions, get in touch.