22/10/2026
At the time of writing this, it'll be no shock to most to hear that there has been an officially recognised "global cyber-security issue" surrounding a critical security flaw in PHP, and that in the UK, 32 .GOV services are unavailable to fix said flaw. We're not aiming to fearmonger, but we felt it was important to highlight the importance of this to businesses as well. As of right now, no documented breaches have occurred as result of this vulnerability, but it can't hurt to take precautions.
Here are our recommendations:
1. Contact your website developer or hosting provider
Ask whether your website uses an affected version of PHP and whether any immediate action is required. They should be able to establish what software your website runs and whether it needs updating.
2. Check for available security updates
If your website is affected, ensure the appropriate security patches are applied in line with the official PHP security guidance. Updates should be tested and deployed appropriately rather than applied blindly to a live production environment.
3. Review your website’s security
Make sure your website’s content management system, plugins, themes and other server-side components are supported and up to date. These are separate considerations, but they form part of the wider security picture.
4. Monitor for suspicious activity
Where appropriate, review available security logs, hosting alerts and web application firewall reports for unusual activity. If you suspect a compromise, investigate it rather than assuming that an update alone resolves the issue.
5. Make sure your backups are usable
Recent, reliable backups can help with recovery if something goes wrong. Ensure they are stored securely and that you know how to restore your website if necessary.