A major security warning for public-sector digital teams
A critical security issue affecting PHP, one of the world's most widely used server-side programming languages, has prompted an urgent response across UK government and local authority digital services.
On 21 October 2026, the National Cyber Security Centre (NCSC) issued an alert urging organisations to take immediate action to address two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Under certain conditions, these flaws could allow an unauthenticated attacker to execute code remotely on an affected server.
The resulting response has led to temporary outages and restricted access to a number of public-sector websites as organisations assess their exposure, apply security updates and work towards restoring services safely.
The Office for Budget Responsibility and several local authorities, including Oxford City Council and the City of Edinburgh Council, were among the organisations reported to have taken websites offline or restricted services as a precaution. In a statement to Parliament on 22 October, the Government confirmed that 32 government services were unavailable and four were partially unavailable at that point, with the disruption largely attributed to precautionary security measures.
Importantly, these outages do not in themselves indicate that the affected organisations were successfully breached. The Government stated that it was not aware of any confirmed compromise of central government systems resulting from these vulnerabilities at the time of its parliamentary update.
What makes these vulnerabilities significant?
PHP underpins a wide range of websites, content management systems and web applications. Its widespread use means that a vulnerability in the language itself can have implications well beyond a single website or software vendor.
The two reported vulnerabilities concern memory handling within PHP. Under certain circumstances, they may enable remote code execution or expose sensitive information held in process memory.
For public-sector organisations, the potential consequences of a successful exploit could include unauthorised access to systems, interference with web applications, exposure of sensitive information and further compromise of connected infrastructure.
The issue is particularly relevant to organisations running content management systems such as Drupal, WordPress and Joomla. NHS England Digital has published a high-severity alert describing demonstrated exploits involving products that integrate PHP.
The key lesson is that securing a content management system requires more than keeping its modules, themes and application code up to date. The underlying runtime, operating system, web server, dependencies and hosting environment must also be maintained.
Why are websites being taken offline?
Taking a public-facing website offline can appear counterproductive, particularly when residents depend on council websites to access essential information and services.
However, when a critical vulnerability cannot be remediated immediately, temporarily withdrawing an exposed service may reduce the opportunity for exploitation.
The NCSC advises organisations to identify systems running PHP, prioritise internet-facing infrastructure, apply the relevant security updates and consider taking systems offline when they cannot be adequately protected in time.
This is a risk-management decision rather than an indication that every affected website has been compromised. The priority is to reduce exposure, verify that remediation has been successful and restore services safely.
For councils and government departments, that decision also requires coordination between digital, infrastructure, cyber security, service delivery and communications teams. Residents need clear information about service availability and alternative ways to access urgent services during disruption.
What does this mean for Drupal developers?
For the Government Drupal Developer Network (GDDN), this incident is a timely reminder that Drupal security cannot be considered in isolation from the infrastructure on which it runs.
Drupal applications depend on a wider technology stack that includes PHP, Composer-managed dependencies, web servers, databases, operating systems, hosting platforms and deployment pipelines.
Even a well-maintained Drupal codebase may remain exposed if the PHP runtime or its supporting infrastructure is vulnerable.
Public-sector Drupal teams should consider the following actions:
1. Audit PHP environments
Identify PHP installations across production, staging, development and supporting infrastructure. Include container images, virtual machines, managed hosting and third-party services where applicable. Do not assume that only older PHP versions require investigation.
2. Apply the appropriate security updates
Review the official PHP security advisory and confirm that deployed environments use a fixed, supported release. NHS England Digital lists PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as the relevant patched release levels for this incident. Organisations should verify the applicable branch and vendor guidance before upgrading.
3. Assess the complete Drupal platform
Review the compatibility of the PHP upgrade with the installed Drupal core version, contributed modules, custom modules, Composer dependencies and hosting configuration. Test critical journeys, integrations, scheduled jobs, forms and authentication before restoring production services.
4. Prepare a controlled recovery process
Where possible, use staging environments, automated tests, repeatable deployment procedures and verified backups. Establish clear approval and rollback arrangements so emergency changes can be delivered without introducing avoidable operational issues.
5. Investigate potential compromise
Patching closes the identified vulnerability but does not establish whether a system was previously exploited. Where exposure warrants it, review relevant logs, unexpected file changes, suspicious processes, new accounts and other indicators of compromise before returning a service to normal operation.
6. Review third-party and managed hosting dependencies
Confirm who is responsible for applying runtime updates when PHP is supplied by a hosting provider, managed service provider or infrastructure platform. Obtain evidence that remediation has been completed rather than assuming responsibility sits elsewhere.
The wider lesson: resilience must be built in
The incident also raises an important question for public-sector digital leaders: how quickly can an organisation identify an exposed system, make a decision, deploy a fix and restore a service?
Effective vulnerability management requires more than reacting to emergency advisories. It depends on accurate asset inventories, supported software, clear technical ownership, tested deployment processes, appropriate monitoring and a reliable incident response plan.
For local authorities in particular, websites are often a critical gateway to services such as council tax, benefits, housing, planning, waste collection and social care information. Even temporary disruption can create additional demand for contact centres and alternative service channels.
Organisations should therefore consider service continuity alongside technical remediation. This includes maintaining accessible alternative information, communicating outages clearly and ensuring that recovery arrangements account for the needs of residents who rely on digital services.
A call for collaboration across the Drupal community
No single organisation can eliminate every vulnerability. However, public-sector teams can reduce the impact of incidents by sharing lessons, strengthening operational practices and coordinating their response to emerging threats.
GDDN encourages government and local-government Drupal teams, developers, infrastructure specialists and digital leaders to review their PHP environments, follow official security guidance and assess their readiness to respond to urgent vulnerabilities.
The incident demonstrates that the resilience of a public-facing website depends on the entire technology stack, not simply the application visible to users.
Secure digital public services require continuous maintenance, clear accountability and collaboration across the teams responsible for keeping them running.
As the Government works to restore affected services and organisations complete their remediation activities, the priority remains clear: protect systems first, verify their security and restore public access as quickly and safely as possible.
Official sources and further reading
- National Cyber Security Centre: Critical security issue affecting PHP
- NHS England Digital: Critical Vulnerabilities in PHP (PHP2Shell)
- UK Parliament, Hansard: Cyber Security: PHP Vulnerability — 22 October 2026
Published by the Government Drupal Developer Network (GDDN). This article provides general technical awareness and is not a substitute for official security advisories or organisation-specific incident response procedures.
