Charities are being urged to check with their website hosts and IT providers following the discovery of two critical security flaws in PHP, software used by many websites and online services. Security fixes are available, and the National Cyber Security Centre (NCSC) is calling for prompt action.
What charities should check
The NCSC recommends identifying PHP systems across an organisation, prioritising internet-facing services, and installing the latest fixed versions. Older installations should move to supported versions; suppliers should confirm the appropriate updated packages.
- Ask your website or IT provider which services use PHP and whether the relevant security fixes have been applied.
- Request confirmation of outstanding actions, who is responsible and when updates will be completed.
- Ask how supplier alerts and future security updates will be monitored.
A practical governance prompt
Trustees can request a short assurance update covering website maintenance and cyber incident arrangements. Civil Society’s 26 October 2026 report also highlights governance research in which more than four in ten charity respondents described board-level cyber preparedness as limited or non-existent.
The alert does not establish that any particular charity has been breached. Where updates cannot be applied promptly, IT specialists should follow the NCSC’s advice on reducing exposure and checking for compromise.
The PHP project has published further guidance since the original announcement, so suppliers should check current advice rather than relying only on the initial release notice.