The UK National Cyber Security Centre urged organizations on October 21, 2026, to prepare for immediate updates to systems running PHP to address two upcoming critical vulnerabilities.
Upcoming security release
According to the NCSC, the PHP Foundation announced on October 20, 2026, that it would issue a security release to address two critical vulnerabilities in the scripting language.
The security release was scheduled for Wednesday, October 21, 2026, at 15:00 BST, though the agency warned that it could arrive earlier.
Guidance for administrators
The NCSC encouraged UK organizations to prepare to update systems using PHP immediately once patches are available. If immediate remediation is not feasible, the agency stated that organizations should consider taking systems offline until the vulnerabilities can be fully mitigated.
Administrators are also advised to inspect their infrastructure for any version of PHP, prioritize internet-facing installations, monitor those systems for malicious activity, and track updates from third-party vendors whose appliances or services bundle PHP.
What to do
- Identify systems running any version of PHP across your infrastructure, prioritizing internet-facing systems.
- Monitor internet-facing PHP systems for malicious activity.
- Monitor official PHP guidance and apply updates as soon as they become available.
- Continuously monitor for security updates from third-party vendors for appliances and services that bundle PHP.
- Consider taking the system offline until it can be fully mitigated if immediate remediation is not feasible.
Key facts and where they come from
- The PHP Foundation announced an upcoming security release on October 20, 2026, addressing two critical vulnerabilities in PHP.
On 20 October 2026, the PHP Foundation announced an upcoming security release addressing two critical vulnerabilities in PHP.
- The security release was set for October 21, 2026, at 15:00 BST, with the possibility of an earlier release.
The release is scheduled for Wednesday, 21 October 2026 at 15:00 BST, but may occur earlier.
- The NCSC recommended taking systems offline if immediate remediation cannot be carried out.
Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
