Published 21 October 2026 | Last updated 22 October 2026
In summary
- No systems under Nine23’s direct control are affected by these vulnerabilities.
- Our public website has been patched, as confirmed by our web partner.
- Customers whose separately managed systems may be at risk have been contacted directly.
What happened
On 21 October 2026, the PHP project released emergency security updates for two critical vulnerabilities in the PHP engine, known together as “PHP2Shell”. Both are rated 9.2 (CVSS v4.0) and can allow an unauthenticated attacker to run code on an affected web server. Details leaked publicly the day before the fix was released, and exploitation attempts have been reported.
What we did
We treated this as an urgent, in-week priority rather than routine patching. The following actions were taken immediately to understand any potential impact.
- Client environments. We reviewed the solutions we manage and contacted the customers we believe may be susceptible. No systems under our direct control are currently affected.
- Our public website. Our website is hosted by a third-party web partner and is separate from Nine23’s corporate services and client platforms. Our web partner applied mitigations following notification and has confirmed that the website is fully patched.
- Our supply chain. We received notifications from a number of our suppliers and partners. We have reviewed each one against the services we rely on.
We believe no further action is needed, and we continue to monitor for updates.
Guidance for organisations running PHP
- Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- PHP 8.1 and earlier are end of life and will not receive a fix. Treat these as a priority for upgrade, replacement or isolation.
- Platforms built on PHP, such as WordPress, Moodle, Magento and Drupal, are exposed even when their own code is clean.
- Ask your hosting provider and suppliers to confirm that they have patched, rather than assuming they have.
Why this matters
Incidents like this test whether an organisation knows what it runs, who runs it on its behalf, and how far a weakness in one system can reach. Knowing your estate, separating public-facing services from corporate and client systems, and holding suppliers to account are what keep an issue like this contained. That is how we run our own estate and the environments we manage for clients.