NCSC urges immediate PHP patching: what New Zealand businesses should do

If your website or web service runs on PHP, you may have a patching job on your hands this week, and you may not know whether it is yours or your supplier's. The National Cyber Security Centre (NCSC) has asked organisations to act quickly. Here is a plain summary of what it said, and the practical questions worth asking.

What's happening

On 22 October 2026 the NCSC published a notice responding to the release of critical vulnerabilities in PHP, a general scripting language. Details are in the NCSC NZ news item, and the two vulnerabilities are listed as CVE-2026-109618 and CVE-2026-109619.

The NCSC says PHP is used by New Zealand organisations in a significant number of websites and web services. It warns that an attacker could use the vulnerability to take full control of a website, web server or web service. That could include defacing or taking down websites.

The day before, the NCSC proactively notified its cyber security customers and trust groups. At 0300 NZDT on the day of the notice, the PHP foundation released a patch. The NCSC's advice is to patch immediately. It also stresses that patching exposed services "will not remove already exploited systems."

What the patch does and doesn't cover

The NCSC makes a few points that are easy to miss:

• The patch protects underlying systems that rely on PHP, but further product and operating system updates may be needed through your software and web service providers.
• The patch only covers actively supported versions through standard updates.
• Older End-of-Life versions stay vulnerable unless teams manually compile custom source patches or receive backports through enterprise operating system vendors.

Who it affects in New Zealand

In short, any organisation that runs PHP anywhere in its environment, or relies on a supplier that does. The NCSC's advice applies to "organisations and individuals using PHP within their environments."

For many Canterbury businesses, PHP is not something you chose directly. It may sit underneath a company website, a customer portal, a booking or ordering system, or an internal web tool that a developer or software vendor built or hosts for you. You might be affected without anyone in your team having ever mentioned the word PHP.

That is why the NCSC also tells organisations to check with their third-party suppliers to establish whether they are using PHP and need to address these vulnerabilities.

Three groups are worth singling out:

• Businesses with public-facing websites or web services, because that is the exposure the NCSC describes.
• Businesses relying on suppliers or agencies to host and maintain those services.
• Businesses running older, End-of-Life PHP versions, because the standard patch does not reach them.

What to do about it

This is a summary of the NCSC's advice, put into an order that works for a business owner or operations lead. Follow the NCSC advisory and PHP's own guidance as the authority.

1. Find out where PHP is in use

Make a short list of every website, web service and web-based system your business runs or depends on. For each one, note who looks after it: your internal team, a web developer, a hosting company or a software vendor. If you cannot answer that quickly, that is useful information in itself.

2. Ask your suppliers directly

Email each supplier and ask three things:

• Does the service use PHP?
• Which version, and is it actively supported?
• When will the fix be applied, and what do you need to do?

3. Patch as a priority

The NCSC recommends patching immediately and monitoring PHP's official guidance. Because the patch only reaches supported versions through standard updates, confirm that the version you run is one of them. Remember that updates from your software and web service providers may also be needed.

4. If you can't patch straight away

The NCSC says organisations that cannot patch immediately should consider disabling public-facing web services. Other mitigations are listed on the PHP alert page linked from the NCSC advisory. The NCSC adds that you should evaluate those mitigations and actively monitor how well they work against the specific risks and conditions of your own environment.

5. Keep watching after the patch

The NCSC recommends actively monitoring for exploitation. Because patching does not remove systems that have already been exploited, the question is not only "are we patched?" but also "has anything already happened?" If you are unsure how to check, ask your IT provider or a qualified security specialist.

6. Watch for further updates

The NCSC says it will provide further updates to trust groups and on its website as information or mitigations become available from the vendor. Details on any further steps beyond what is above:

Our take

This section is our view, not the NCSC's.

In our experience, the hard part of a notice like this is rarely the patch itself. It is knowing quickly what you run, who is responsible for it, and whether it is still supported. Businesses that can answer those three questions in an hour are in a much calmer position than those that need a week of emails.

We also think the End-of-Life point deserves more attention than it usually gets. A website that "just works" can quietly drift onto a version that no longer receives standard updates. That is a planning issue as much as a technical one. Having someone own the list of what is running, and when each piece reaches the end of its support, turns a scramble into a routine job. That is how we think about it when we plan, run and improve technology for New Zealand businesses.

Finally, we would encourage a measured response. The NCSC is clear and direct, so follow its advice and use its advisory as your reference. There is no need to panic, but the guidance is to act promptly. We are an IT consultancy and managed services provider, not a security specialist, so where you have concerns about possible exploitation, involve a qualified security professional.

General information only. Every business is different, so contact us to discuss your situation.

Frequently asked questions

How do I know if my business uses PHP?

Often you will not know without asking. PHP can sit underneath websites and web services built or hosted by someone else. The NCSC recommends checking with your third-party suppliers to establish whether they use PHP and need to address these vulnerabilities.

If I apply the patch, am I safe?

Not necessarily. The NCSC says patching exposed services will not remove already exploited systems, and it recommends actively monitoring for exploitation. The patch also only covers actively supported versions through standard updates, so older End-of-Life versions may remain vulnerable.

What if we can't patch right away?

The NCSC says to consider disabling public-facing web services. It also points to other mitigations on the PHP alert page linked from its advisory. It recommends evaluating and actively monitoring how well those mitigations work in your own environment.

If you would like help working out where PHP sits in your business, what your suppliers need to confirm, or how to plan support for older systems, get in touch with NextGen Solutions in Christchurch. You will speak directly with senior consultants, with no account manager layers, and you will get straight answers.