Published:
23 October 2026
NCSC has published guidance on urgent actions to mitigate newly discovered vulnerabilities in PHP, a widely used server-side scripting language commonly used in networked systems.
Noting the significant security risks posed to regulated services, we encourage all communications providers and Operators of Essential Services within the digital infrastructure subsector give urgent consideration to the NCSC advice. We recognise the complexity of this issue for the sector and will be engaging with supervised services in the days and weeks to come to understand vulnerability remediation in the context of regulatory duties.