23/10/2026
On Tuesday night, details of two serious PHP vulnerabilities leaked before a fix was available.
PHP sits behind a huge number of websites, including WordPress sites and web applications, so this wasn’t something we wanted to wait around on.
Our first question was simple: Are our clients affected?
Within about an hour, we’d:
• Checked 290 client websites and domains
• Checked 330 office internet connections
• Identified at-risk sites that needed patching or another plan
• Prioritised what the team needed to tackle first
Not because of heroics. Because the hard work had already happened.
We knew what our clients had. We could check it quickly. And we knew what happened next.
Good cybersecurity starts before the emergency.
Because “we’ll find out if it happens” isn’t much of an incident response plan.