NCSC warning: a critical vulnerability in PHP affects every version. Act today.

PLEASE SHARE THIS COMMUNICATION

When forwarding please respect the integrity of CSSC messages and do not alter the content or formatting of the authoritative message.

Industry Sector Leaders,

As you may already be aware the UK’s National Cyber Security Centre (NCSC) has issued an urgent warning about a serious cyber security vulnerability affecting PHP, a technology that underpins many websites, online services and applications. If left unpatched, the flaw could allow unknown actors to gain unauthorised access to affected systems, potentially leading to service disruption, theft of data, or further compromise of organisational networks. The issue is affecting organisations across both the public and private sectors, particularly those operating websites or online services that rely on PHP, either directly or through third-party suppliers.

London Impact

We are aware that many Partners, Local Authorities and Information Security for London have been working extremely hard over the last 24 hours to patch vulnerabilities working with providers to secure systems as quickly as possible. As a result, based on current reporting, no significant impacts have been identified at this time.

Organisations using any version of PHP are affected and all organisations are highly encouraged to update to the latest fixed version. Should organisations in London not implement the necessary mitigations and patches, there is a risk that multiple London partners could experience simultaneous cyber incidents, potentially resulting in widespread service disruption and broader impacts across the London.

For action:

• (Immediate) Ensure your IT, Digital and Cyber Security teams assess whether your organisation uses PHP and, where it does, implement the latest security updates and mitigations in line with guidance from the National Cyber Security Centre (NCSC) and software vendors (below or their website).
• Local Authorities - If your CIO is a member of London’s public sector Warning, Advice & Reporting Point (WARP) (Information Security for London - ISfL), you can also use this channel as a source of technical information.
• Monitor for signs of compromise, unusual system activity, or service disruption, and follow internal cyber incident management and reporting procedures where concerns are identified.
• Report any significant incidents, disruption to critical services (that exceed your business continuity arrangements), or issues with wider pan-London implications through to londonresilience@london.gov.uk

NCSC Guidance

The NCSC highly encourages organisations to follow these priority actions:

1. Identify systems running PHP across your infrastructure, prioritising internet-facing systems. As all versions may be affected, do not limit discovery to outdated PHP versions; identify PHP installations generally and assess their exposure to CVE-2026-109618 and CVE-2026-109619.
2. Update to the latest version of PHP and continue to monitor for future updates.
3. If you are unable to update to a version with the security update applied, the PHP Foundation have provided temporary mitigations.
4. If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.
5. If you are unable to update or disable the system immediately then you should assess the system for any evidence of compromise prior to your upgrade or mitigation and look for backdoors installed by an attacker. If you are not confident in your ability to do this yourselves then you can get assistance from an NCSC-assured Cyber Incident Response provider.
6. Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP. NCSC-NL have published an inventory list of software products with a PHP dependency potentially affected by the vulnerabilities. Apply relevant updates as they become available.

Next steps

London Resilience will continue monitor for Partner impacts and share information as relevant. Should pan-London impacts be experienced, we may look to convene a Cyber Technical Advice Cell (CTAC) as part of activation of the London Resilience Partnership Cyber Incident Response Framework.

Please send any impact to key services by 10am Friday 23 October 2026 to LondonResilience@london.gov.uk.