Critical vulnerabilities affecting PHP have prompted organisations to assess their exposure and prepare to take action as further information and official security updates become available.
As the situation continues to develop, VP of Cyber Intelligence and Response, Matt Hull shares practical guidance for organisations using PHP, from identifying affected deployments and reducing exposure to monitoring trusted sources for the latest security advice.
Advice updated to reflect the state of play following the release of PHP patches on 21.10.2026:
“The release of the PHP patches is an important step, but organisations should not mistake patching for proof that their systems are clean. We are now seeing reports of exploit activity, which makes the window between these vulnerabilities becoming known and systems being patched particularly important. There is a real possibility that vulnerable systems could already have been compromised, including the creation of backdoors.”
“The potential impact is serious. Successful exploitation could provide remote shell access and potentially allow an attacker to move laterally into other parts of an organisation’s environment. Organisations managing their own PHP systems, particularly internet-facing deployments, therefore need to understand not only whether they have patched, but whether there are signs that an attacker gained access before they did.”
“Our previous advice still stands: identify all PHP deployments across your environment and apply the official security updates immediately. If you have not yet been able to patch an affected internet-facing system, appropriately isolate or disconnect it until it can be remediated. Once patched, organisations should investigate the period of exposure and monitor closely for indicators of compromise rather than assuming the risk has passed.”
“NCC Group continues to monitor developments closely. Organisations concerned about their exposure can reach out to us for advice, and our Threat Intelligence and threat hunting teams are working on ways to help organisations identify possible exploitation."
Initial advice published pre-patch:
“The immediate priority for organisations should be understanding their exposure. Security teams should identify and inventory all PHP deployments across their environments, including those embedded within third-party applications and vendor-supplied software, and be ready to apply official security updates as soon as they become available.
“Where systems cannot be immediately remediated, particularly those running end-of-life versions of PHP, organisations should look to reduce their exposure by isolating them from the internet wherever possible or introducing appropriate compensating controls. Given the critical nature of the vulnerabilities, organisations should also consider taking affected internet-facing systems offline until they can be properly mitigated, where this is operationally feasible.
“There is a significant amount of information circulating as the situation develops, so organisations should avoid acting on unverified reports. Continue to monitor official PHP guidance and advice from trusted authorities such as the UK’s National Cyber Security Centre, or the relevant national cyber security authority in your country, and be prepared to act quickly as further information becomes available.”
Matt Hull biography
Matt Hull is Vice President of Cyber Intelligence and Response at NCC Group, leading the global Cyber Response and Intelligence (CRI) capability.
A former Detective Constable specialising in cybercrime, Matt brings deep operational experience across investigation, response, and intelligence-led operations. He leads multidisciplinary teams supporting organisations through complex incidents, advanced threat activity, and the development of mature detection and response capabilities.
Matt is recognised across the industry for his authenticity and clear communication, speaking at major conferences and featuring in media including BBC News, the Financial Times and Channel 4’s Hunted. He also serves as Chair of the Threat Intelligence Focus Group and sits on the CREST International Council.