22 October 2026
The NCSC is responding to the release of critical vulnerabilities in the general scripting language, PHP. This coding language is used by New Zealand organisations in a significant number of websites and web services.
This vulnerability could be used by an attacker to take full control of a website, web server or web service; this could include defacing or taking down websites.
Yesterday, the NCSC proactively notified cyber security customers and trust groups to be alert to the risk and advised them to monitor PHP’s website and apply any updates as a matter of priority. A vulnerability alert has been posted on the NCSC website.
NCSC's advice to organisations and individuals using PHP within their environments is to monitor PHP official guidance, apply security patches as they become available, and actively monitor for any exploitation. Patching the exposed services will not remove already exploited systems.
At 0300NZDT this morning a patch was released by the PHP foundation who is responsible for the programming language.
This patch will protect underlying systems that rely on the PHP programming language, but further product and operating system updates may be required via software and web service providers.
The released patch will only protect systems on actively supported versions via standard updates. It leaves older End-of-Life versions vulnerable unless teams manually compile custom source patches or receive backports through enterprise OS vendors.
The NCSC recommends that organisations patch immediately. If organisations are unable to patch immediately, then they should consider disabling public-facing web services.
Where immediate patching is impractical, other mitigations are available on the PHP alert page which is linked to in the NCSC’s advisory. The NCSC recommends that organisations implementing these mitigations evaluate and actively monitor their effectiveness against the specific risks and conditions of their own environments.
Organisations should check with their third-party suppliers to establish if they are using PHP and need to address these vulnerabilities.
The NCSC will provide further updates to trust groups and on its website as information or mitigations become available from the vendor.