NCSC PHP alert: a ready-to-copy email for your web host or IT provider

Published 22 October 2026. Based on the NCSC alert of 21 October 2026.

The NCSC alert of 21 October 2026 asks every organisation using PHP to find where it runs and update it. If a web designer, hosting company or IT provider looks after your website, the quickest way to act is to ask them, in writing, the right questions. Below is an email you can copy, fill in and send today.

For the background, read our plain-English guide to the NCSC PHP security alert. In short: the NCSC says the issue "may allow attackers to execute commands on any web server running PHP", that "organisations using any version of PHP are affected", and that "this security issue has now been fixed". The job now is to make sure the fix has reached your systems.

Before you send it

• Send it to everyone who runs part of your web presence. That may be more than one company: a web designer for the site, a hosting company for the server, an IT provider for the practice network, and a supplier for an online booking or referral system.
• Fill in the brackets at the bottom. Add your name, role and organisation so the reply can go straight into your records.
• Ask for a reply date. A few working days is reasonable for an alert like this. If you hear nothing, follow up by phone.
• Do not send passwords or ask for them. None of these questions needs login details.

The email to copy

Subject: NCSC PHP security alert (CVE-2026-109618 and CVE-2026-109619): please confirm our position

Hello,

On 21 October 2026 the National Cyber Security Centre published an alert about a critical security issue in PHP (CVE-2026-109618 and CVE-2026-109619). The NCSC says it may allow attackers to execute commands on web servers running PHP, and that organisations using any version of PHP are affected:
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

Please could you confirm the following for every website, online form and system you look after for us:

1. Which of our systems run PHP, including our website, booking or contact forms, and any portals or intranets.
2. Which PHP version each one is running today.
3. Whether each has been updated to a version fixed for CVE-2026-109618 and CVE-2026-109619, or whether the PHP Foundation's temporary mitigations have been applied instead.
4. The date the update or mitigation was completed, or the date it is planned for.
5. Whether any plugins, themes or third-party products we use bundle their own copy of PHP, and whether their suppliers have issued updates.
6. Whether you have checked for signs of compromise or backdoors, what you checked, and what you found.
7. If anything cannot be updated or mitigated quickly, what you recommend, including whether it should be taken offline until it is fixed.

Please send your answers in writing, as we will keep them as evidence for our Data Security and Protection Toolkit (DSPT) and data protection records.

If you find any sign of compromise, please tell us straight away.

Thank you,

[Your name]
[Job title]
[Practice or organisation name]
[Phone number]

Why these seven questions

Each question maps to one of the actions in the NCSC alert, so the answers show you followed official advice.

1. Which systems run PHP. The NCSC's first action is to identify all PHP installations, with internet-facing systems first.
2. Which version. You cannot judge whether something is fixed without knowing what is installed.
3. Fixed or mitigated. The NCSC asks you to update to the latest PHP version, or, if you cannot, apply the PHP Foundation's temporary mitigations.
4. The date. A dated record is far stronger evidence than "we think so".
5. Bundled PHP. The NCSC asks organisations to monitor third-party vendors, including products that bundle PHP, and apply their updates.
6. Signs of compromise. The NCSC recommends checking for signs of compromise and backdoors, particularly on systems that could not be updated straight away.
7. What if it cannot be fixed. The NCSC says to consider taking a system offline until it is fully mitigated.

What a good answer looks like

A good reply names each system, gives its PHP version, says whether it was updated or mitigated and on what date, and says what was checked for compromise. Vague replies such as "all our servers are kept up to date" are a start, but they will not help much if you are later asked to show evidence. Politely ask for the specifics.

If the answer is that a system could not be updated, ask what the plan is and when. If the reply mentions anything suspicious, treat it seriously. The NCSC recommends seeking help from an NCSC-assured Cyber Incident Response provider if you are unsure. Unavoidably Secure is not an incident response provider.

Keep the reply as evidence

Save the reply with your Data Security and Protection Toolkit (DSPT) evidence, or in your data protection records if you do not complete the DSPT. It shows that you know who your suppliers are, that you asked them to act on an NCSC alert, and that they did. That supports what the DSPT expects about managing suppliers and vulnerable software, and your duty under UK GDPR to keep personal data secure, including data that suppliers handle for you.

How the free external audit helps

Our free external audit includes a check of what your public website reveals about the software it runs, including PHP. It flags what is visible from outside and gives you a short list of what to ask your IT provider or web host. It does not need access to your systems. It cannot prove that a site is patched or that it has not been compromised: only the people who run the server can confirm that, which is why the questions above matter.

Common questions

This page is general information based on the NCSC alert published on 21 October 2026, accurate at the time of writing, and is not legal advice. Always follow the latest version of the NCSC alert. Unavoidably Secure is not an incident response provider, and no assessment certifies compliance with any standard or proves that a system is patched or free of compromise.