Published 22 October 2026. Based on the NCSC alert of 21 October 2026.
On 21 October 2026 the National Cyber Security Centre (NCSC) published an alert about a critical security issue in PHP, the software behind a large share of the web, including WordPress. The NCSC says the issue "may allow attackers to execute commands on any web server running PHP". Fixes are available. This page explains what that means for a dental practice, care provider or small charity, and gives a practice manager a simple checklist.
On this page
The alert in plain English
PHP is a programming language that runs on web servers. It powers WordPress and many other website, booking and form systems. The NCSC alert covers two security issues, CVE-2026-109618 and CVE-2026-109619.
In the NCSC's words, an out-of-memory condition can cause memory corruption, and "under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution." Put simply, someone on the internet, without logging in, might be able to make your web server run their own commands. That could mean a defaced website or stolen form submissions.
The good news is that "this security issue has now been fixed", according to the NCSC. Updated versions of PHP have been released. The NCSC alert does not report any attacks using the issue so far, and says the NCSC "will continue to monitor for any impact on UK organisations." Even so, the time to update is now.
Who is affected
The NCSC is clear: "Organisations using any version of PHP are affected and all organisations are highly encouraged to update to the latest fixed version."
For most practices, care providers and charities, PHP is not something you chose. It came with your website. Many practice, care and charity websites, and many online booking, referral and patient forms, run on WordPress or other PHP software, usually looked after by a web designer or a hosting company. PHP can also be built into products you buy, and the NCSC asks organisations to watch for updates from those vendors too.
A 7-step checklist for practice managers
You do not need to be technical to manage this. These steps follow the actions in the NCSC alert.
- List your websites and online forms. Your main website, any booking or referral forms, patient or family portals, staff intranets and old microsites. Put the ones open to the internet first, as the NCSC advises.
- Write down who looks after each one. Your web designer, hosting company, IT provider or software supplier. If nobody is named for a site, that is your first finding.
- Ask each of them whether it runs PHP, and which version. Use our ready-to-copy email.
- Ask them to update to the latest fixed PHP version. If they cannot do that straight away, ask them to apply the PHP Foundation's temporary mitigations, which the NCSC alert links to.
- Agree what happens if neither can be done quickly. The NCSC says to consider taking the system offline until it is fully mitigated.
- Ask for checks for signs of compromise. The NCSC recommends checking systems for signs of compromise and backdoors, especially any that could not be updated or switched off immediately.
- Get written confirmation and file it. Ask for the date the work was done and what was done, and keep it with your DSPT or data protection evidence.
What to ask your web host and IT provider
Keep the questions specific so the answers are easy to file:
- Which of our websites, forms and systems run PHP, and which version is each on today?
- Have they been updated to a version fixed for CVE-2026-109618 and CVE-2026-109619, or have the PHP Foundation's temporary mitigations been applied? On what date?
- Do any plugins, themes or third-party products we use bundle their own copy of PHP, and have their suppliers issued updates?
- Have you checked for signs of compromise, such as unexpected files, new administrator accounts or unusual outbound connections?
- Can you confirm all of this in writing for our records?
Not sure what your website runs?
Start with our free external audit. We check what your public website reveals about its software, including PHP, and tell you what to ask your IT provider or web host. No charge, no obligation, and no access to your systems.
Request your free auditOr email support@unavoidablysecure.com
How this links to the DSPT and UK GDPR
If you complete the NHS Data Security and Protection Toolkit (DSPT), the toolkit expects you to manage unsupported and vulnerable software and to know that your suppliers protect the data they handle for you. Version 9 (2026-27) says "supplier" rather than "IT supplier", so your web host and web designer count. A dated, written confirmation that a critical issue flagged by the NCSC was dealt with is exactly the kind of evidence that shows a control actually works. Our DSPT guide for dental practices and DSPT guide for care homes explain the wider picture.
Under UK GDPR you must keep personal data secure with appropriate technical measures, and you remain responsible when a processor, such as a hosting company, handles it for you. If your website collects enquiries, bookings or referrals, that data is in scope. If the issue leads to a breach of personal data, you may need to report it to the ICO within 72 hours of becoming aware of it.
When to call an incident response provider
Call for specialist help if your IT provider finds signs of compromise, if a system could not be updated promptly and you are unsure whether it was attacked, or if you notice unexpected pages, redirects or new admin users. The NCSC recommends seeking help from an NCSC-assured Cyber Incident Response provider. Unavoidably Secure is not an incident response provider, and we will point you to that list rather than attempt it ourselves.
How the free external audit helps
Our free external audit includes a check of what your public website reveals about the software it runs, including PHP. It flags what is visible from outside and gives you a short list of what to ask your IT provider or web host. It does not need access to your systems. It cannot prove that a site is patched or that it has not been compromised: only the people who run the server can confirm that, which is why the questions above matter.
Common questions
What is the NCSC PHP alert of October 2026?
On 21 October 2026 the NCSC warned of a critical security issue in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, that may allow attackers to execute commands on web servers running PHP. Fixes have been released and the NCSC advises updating to the latest PHP version.
Does this affect our practice website?
It may. The NCSC says organisations using any version of PHP are affected. WordPress and many booking and form systems run on PHP. Ask your web host or IT provider whether your site runs PHP and whether it has been updated.
Has the PHP issue been exploited?
The NCSC alert does not report any exploitation. It says the NCSC will continue to monitor for any impact on UK organisations. Update promptly anyway.
Who should we call if we think we have been compromised?
Contact your IT provider straight away and consider an NCSC-assured Cyber Incident Response provider, as the NCSC recommends. If personal data may be affected, check whether you need to report it to the ICO within 72 hours.
This page is general information based on the NCSC alert published on 21 October 2026, accurate at the time of writing, and is not legal advice. Always follow the latest version of the NCSC alert. Unavoidably Secure is not an incident response provider, and no assessment certifies compliance with any standard or proves that a system is patched or free of compromise.