You may have seen news of two critical security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), announced on 21 October. PHP is a widely used web technology, and the NCSC is advising all UK organisations to identify affected systems and update them urgently. A working exploit is reported to be circulating, so this is not one to leave until half term.
What Wave 9 has done
We have reviewed our own estate. The connectivity and edge equipment we provide to your school does not use PHP and is not affected. We have also checked with our key suppliers and updated our own systems.
What this means for your school
Any system that your school owns or manages, or that a third party hosts on your behalf, may run PHP without that being obvious. The most common places to look are:
- Your school website – especially if it runs on WordPress, Joomla or Drupal. Check with whoever hosts it that both the site and the PHP version on the server have been updated.
- On-site web applications – parent portals, library systems, cashless catering, room or visitor booking, print management, intranet pages.
- IT and helpdesk tools – ticketing systems, monitoring dashboards, asset registers.
- Appliances with a web admin page – web filters, VPN gateways, NAS/backup boxes (Synology and QNAP both bundle PHP), door-access or CCTV controllers.
- Anything hosted for you by a supplier – ask them directly whether PHP is in use and whether it has been patched.
What to do
- Make a list of every system above and who is responsible for it (you, your IT provider, or a supplier).
- For each, confirm it has either been updated or does not use PHP. Vendors are publishing advisories now; where there is no advisory yet, ask.
- Make sure no admin or management interface is reachable from the internet. If one is, restrict it today regardless of whether it is patched.
- If a system cannot be updated promptly, take it offline until it can be.
The NCSC guidance is here: Critical security issue affecting PHP