23 October 2026
Dr Emma Bickerstaffe, Director of Cyber Defence Operations at the National Cyber Security Centre, said businesses should engage with their website providers and hosting companies as soon as possible to understand any potential impact.
“If you're not sure whether your website uses PHP, the first step is to contact your website developer, IT provider or hosting company. They can tell you whether your website or services could be affected and whether the latest security updates have been applied.”
The critical vulnerability is in the coding language PHP, which is used in a significant number of websites and web services used by organisations.
“This vulnerability could be used by an attacker to take full control of a website, web server or web service, and could include defacing or taking down websites. All systems using PHP need to patch the software.”
The NCSC advises that businesses may be affected if they use a content management system such as WordPress that relies on PHP, if their website or online services are hosted by a third-party provider using PHP, or if they run web applications that depend on PHP.
“If you are unsure, businesses should ask their website developer, IT provider or hosting company whether the latest PHP security update has been applied. You can also ask whether any systems are affected by the vulnerability, whether checks have been undertaken to identify any compromise prior to patching, and whether any additional actions are required to secure their systems.”
Dr Bickerstaffe said that if updates cannot be applied immediately, they should also seek information about temporary measures being used to reduce risk.
“Businesses should not assume that applying an update is the end of the process,” said Dr Bickerstaffe. “Providers should also be checking for signs of unusual activity, including unexpected changes to websites, the creation of new administrator accounts, outages or poor performance, and unusual login or system activity.”
Dr Bickerstaffe noted that internet users do not need to take action simply because they have visited a website that uses PHP.
“This vulnerability affects the systems delivering website content or services,” said Dr Bickerstaffe. “People browsing the internet do not need to take action, and visiting a website that uses PHP does not place phones or home computers at risk.”
Dr Bickerstaffe said it remains too early to determine the full impact of the vulnerabilities on New Zealand organisations.
“At this point the priority for businesses is to confirm whether they are affected and ensure appropriate security updates and checks have been completed as a priority.”