The National Cyber Security Centre has warned of two critical flaws in PHP, software that powers millions of websites, and says organisations should act immediately

Somerset businesses are being urged to check that their websites are secure after the UK’s National Cyber Security Centre (NCSC) issued an alert about two critical vulnerabilities in PHP, software used to run websites and web applications worldwide. If left unpatched, the flaws could allow attackers to run commands on affected web servers without needing to log in.

Any business with a website could be affected, particularly those built on WordPress or other PHP-based platforms, unless the underlying PHP installation on their hosting server has received the security fixes. Many business owners assume that keeping WordPress and its plugins up to date is enough, but updating those alone does not update PHP on the server.

The advice for Somerset businesses is simple and urgent: contact your website provider, hosting provider or IT team today to confirm the fixes have been applied.

The NCSC recommends that organisations take the following steps:

• Identify PHP installations across the organisation, prioritising internet-facing websites and applications, and check all versions, not just outdated ones.
• Update PHP immediately to a release containing the security fixes, and keep monitoring for further updates. Those using an older version should move to a fully supported version or confirm with their provider that a patched package is available.
• If an immediate update is not possible, follow the temporary mitigation advice linked from the NCSC notice. These measures reduce exposure but do not provide complete protection, so updating PHP remains essential.
• If temporary mitigations cannot be applied, or would take too long, consider taking affected systems offline until they can be secured.
• If systems cannot be updated or disabled immediately, check for evidence of compromise, including attacker-installed backdoors, before upgrading or applying mitigations.

For small and medium-sized businesses, a compromised website can mean lost trade, damaged customer trust and costly clean-up, so a quick check now is well worth the effort.

Read the NCSC’s full guidance, including links to PHP’s security updates and temporary mitigations: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php