NCSC warns of imminent critical PHP flaw
NCSC urges UK organisations to prepare for emergency PHP patching ahead of a critical fix due 21 October 2026.
Sourcencsc.gov.uk — open the original
What to check
- Applies to
- Not tied to a specific actor, malware or CVE, only to the sectors it covers, so it may be general reporting. Check the source before acting on it. Whether it concerns you is not assessed.
The UK National Cyber Security Centre (NCSC) has issued an advance warning that a critical security issue affects PHP, the widely used server-side scripting language that underpins a large proportion of web applications and backend services. No CVE identifier, technical details, or proof of exploitation have been published yet; the advisory is a pre-emptive call to action ahead of a scheduled fix release on Wednesday, 21 October 2026 at 15:00 BST, which may be moved earlier.
NCSC is advising organisations to identify every system running any version of PHP across their estate, with particular priority on internet-facing deployments, and to begin monitoring those systems for signs of malicious activity in advance of the patch. Where immediate patching will not be feasible once the fix is released, NCSC recommends taking the affected system offline until it can be fully remediated, indicating the issue is expected to be of significant severity and broad applicability (PHP is embedded in many third-party products beyond direct web server use).
Defenders should treat this as an urgent, time-boxed readiness exercise: build an inventory of PHP instances and versions now, prepare change-management and patch windows for the imminent release, and ensure logging/monitoring is in place on internet-facing PHP applications so that any exploitation attempts before or after disclosure can be detected. Watch the NCSC page and vendor PHP release notes for the forthcoming CVE and patch details.
Source reporting: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs