Some may already be aware, but there’s a serious incident being reported regarding a PHP update that will fix possible remote code execution vulnerability due to drop this afternoon at 15:00 BST (or possibly earlier if details leak). Technical details here:
https://www.php.net/archive/2026.php#2026-10-20-1
The National Cyber Security Centre has also put out a statement:
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
We and in particular our hosts Mythic Beasts are monitoring the situation. They are currently planning to deploy updates for affected customers as quickly as possible.
If the exploit looks bad and we see suggestions of automated scanning/exploitation and Mythic are planning on turning off PHP on affected services until they can update, which will cause some disruption, but in line with the NCSC guidance they believe this to be the safest option for protecting your service and your data.
As always please feel free to contact us if you have further questions,
but please note that we are extremely busy dealing with this incident and similar attacks on WordPress platforms at the moment, so it will take a lot longer than usual to reply.
