Français

Note to NPC clients:

NPC DataGuard devices and systems are not affected by this issue. NPC computers do not run PHP web services, and no action is required on your NPC device. This alert is to clarify the issue, and in case you have a website running on PHP that you or another provider manages.

What is the issue

On October 21, 2026, the PHP Foundation Security Team released emergency updates to fix two critical security weaknesses in PHP, a technology that powers business websites, customer portals, and online applications, including WordPress. Both weaknesses have a severity rating of 9.2 out of 10, and affected systems need to be updated immediately.

Attackers could run commands on affected servers without logging in. This could allow them to steal data, change a website, install malware or ransomware, or use the server to attack others. Researchers used advanced security testing tools, including AI-assisted techniques, to uncover the weaknesses. Experts warn that similar tools could also help attackers identify vulnerable systems.

What does it mean for you

The direct risk is to systems running affected PHP web services. Your business website, client portal, or services managed by other providers may be affected. Ask your website or IT provider to check these, starting with systems accessible over the internet. Having a security weakness does not necessarily mean someone has broken into the system.

If your website uses WordPress, PHP itself still needs to be updated. Updating WordPress, its themes, or its plugins alone will not fix this issue.

What should you do?

Contact your website or IT provider

Ask whether your website or business applications use affected versions of PHP. Confirm who is responsible for applying the security updates and when they will be completed. Check with providers of critical business services, such as client portals, customer management, scheduling, or file-sharing tools, about whether they were affected and have applied the updates.

Confirm that PHP has been updated

The security fixes are included in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your site runs PHP 8.1 or older, ask your provider about an immediate upgrade to a supported version or a security fix supplied for that older version.

Address systems that cannot be updated promptly

If an immediate update is not possible, discuss temporary protection with your provider. Systems accessible over the internet should receive priority. Consider restricting access or taking an affected site offline temporarily until a fix can be applied. Temporary measures do not replace the required security update.

Check for suspicious activity

Ask your technical team or provider to review system records for signs of unauthorized access, such as unexpected files, accounts, or activity. Applying the update fixes the security weaknesses, but it does not undo any damage from an earlier attack.

Be cautious when using other websites

Be especially cautious with websites that may not be regularly maintained. Avoid entering sensitive personal or client information on sites you do not trust, and do not reuse passwords across sites.

Watch for scams

Cyber criminals often use major security news to trick people. Be wary of unexpected emails or calls urging you to “update” or “verify” your website or accounts. Contact your provider through your usual channels to confirm any request.

We are closely monitoring the situation and will issue updates to this alert as may be required for material issues.

Sources:

• Blackbourn, J. (2026) Critical PHP Security Release. WordPress, 21 October. Available at: https://wordpress.org/news/2026/10/critical-php-security-release/ [Accessed 22 October 2026].
• Canadian Centre for Cyber Security (2026) AL26-026 – Critical vulnerabilities impacting PHP – CVE-2026-109618 and CVE-2026-109619, 21 October. Available at: https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619 [Accessed 22 October 2026].
• Cybersecurity and Infrastructure Security Agency (CISA) (2026) Critical Vulnerabilities in PHP Require Immediate Patching, 21 October. Available at: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching.
• Cyber Security News (2026) Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched. Available at: https://cybersecuritynews.com/critical-php-vulnerabilities/.
• PHP Group (2026) Security advisory: Critical remote code execution vulnerabilities, update now, 21 October. Available at: https://www.php.net/index.php [Accessed 22 October 2026].
• Zorz, M. (2026) PHP2Shell: Critical PHP vulnerabilities patched, update now! Help Net Security, 21 October. Available at: https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/ [Accessed 22 October 2026].

Receive our NPC Security Alerts email to stay on top of the most important security threats to your devices, data, and your privacy. We do not use this list for any other purpose.