Some may already be aware, but there’s a serious incident being reported regarding a PHP update that will fix possible remote code execution vulnerability due to drop this afternoon at 15:00 BST (or possibly earlier if details leak1). Technical details here:
https://www.php.net/archive/2026.php#2026-10-20-1
The National Cyber Security Centre put out a statement:
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
We and in particular our hosts Mythic Beasts are monitoring the situation. They are currently planning to deploy updates for affected customers as quickly as possible2.
If the exploit looks bad and we see suggestions of automated scanning/exploitation and Mythic are planning on turning off PHP on affected services until they can update, which will cause some disruption, but in line with the NCSC guidance they believe this to be the safest option for protecting your service and your data3.
As always please feel free to contact us if you have further questions, but also please note that we are extremely busy dealing with this incident and similar attacks on WordPress platforms at the moment, so it will inevitably take a lot longer than usual to reply.
- We were informed at 13:52 UTC. In the event plans were accelerated as details of the security hole were leaked. ↩︎
- The Ourlocality server and PHP were updated at 16:52 UTC ↩︎
- In the event, we understand that Mythic didn’t shutdown the service except for the short duration of the update. ↩︎
