NCSC tells UK organisations to update PHP after a critical flaw

PHP has fixed a flaw that can let attackers run commands

PHP is a widely used language for building websites. PHP has published a security update for a critical issue that may let attackers run commands on any web server that runs PHP.

Under certain conditions, the flaw can be used to run code without signing in. The issue is now fixed, but only for systems that install the update.

The NCSC says organisations using any version of PHP are affected. It asks all of them to move to the latest fixed version.

The NCSC wants every PHP system found and updated

The first task is to find PHP. The NCSC asks organisations to look across all their systems, starting with those that face the internet. It says not to look only for old versions, because all versions may be affected.

Where the update or the temporary fixes cannot go on quickly, the NCSC says to consider taking the system offline until it is safe. Some organisations cannot check a system for signs of attack themselves. They can get help from an NCSC-assured Cyber Incident Response provider.

That advice stood out. Joe Tidy said on Bluesky that it was unusual to see all the cyber authorities saying patch or take offline. He asked whether it was a first.

For smaller firms, the fix often sits with a supplier

Many small and mid-size firms do not run their own web servers. A web agency, a hosting firm or a software supplier does it for them. The NCSC asks organisations to watch for updates from those suppliers too, including products and services that may have PHP built in.

So the useful question this week is a short one. Ask each supplier that runs a website or system for you whether it uses PHP, and when the update will be in place.

The alert also fits a wider warning. On 1 May 2026 the NCSC told organisations to prepare for a patch wave, a rush of software updates across the technology stack. It said every organisation, whatever its size, should plan for it. Its default is to apply updates as soon as possible, ideally automatically.

The NCSC will keep watching for UK impact

The NCSC says it will continue to monitor for any impact on UK organisations. It also asks organisations to keep watching for further updates from their software suppliers.

Any organisation based in the UK can sign up to the NCSC's free Early Warning service. It sends email alerts about malware and vulnerabilities that affect the organisation's own network.