THE NCSC is urging UK organisations to prepare to update systems running PHP after the PHP Foundation announced on 20 October 2026 that an upcoming release will fix two critical vulnerabilities. The release is scheduled for Wednesday, 21 October 2026 at 15:00 BST, but may be issued earlier. The article does not provide vulnerability identifiers, affected versions or details of how the flaws could be exploited.
Organisations are advised to identify PHP across their infrastructure, prioritising systems exposed to the internet, and monitor those systems for malicious activity. They should follow official PHP guidance and install updates as soon as they are available, while also watching for fixes from third-party vendors whose products or services include PHP. If immediate remediation is not feasible, the NCSC says organisations should consider taking affected systems offline until they can be fully mitigated.