Edvolve

Intended audience: School leaders, school business managers, IT managers, public-sector decision-makers and those responsible for website procurement, maintenance and security.

Technology and Security

Critical PHP vulnerabilities have prompted urgent action worldwide. For schools and public bodies, the incident is a timely reminder to look beyond a website's appearance and understand the technology, security and maintenance behind it.

On 21st October 2026, the release of critical security updates for PHP triggered an international response. Government websites and other online services were taken offline as organisations assessed their exposure and worked to apply the necessary fixes.

The UK National Cyber Security Centre (NCSC) urged organisations to identify systems running PHP, prioritise those exposed to the internet and apply the available updates. Where immediate remediation was not possible, organisations were advised to consider taking affected systems offline until they could be adequately protected.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code on affected servers without authentication, and the scale of the response has brought an important issue into focus - what happens when the technology underneath a website becomes a security risk?

For schools and public bodies, it is a question worth asking long before the next critical vulnerability makes the headlines.

The problem is bigger than a single vulnerability

PHP is a widely used programming language that runs on web servers to support websites and applications. It also underpins popular content management systems, including WordPress, as well as a range of other software products and services. This widespread adoption is one reason a vulnerability in PHP can have such a broad impact. A weakness in a shared underlying component can affect many different websites and services, even when they have been developed and managed by entirely separate organisations.

The latest vulnerabilities are not specific to WordPress, they affect PHP itself, meaning that any organisation running an affected PHP environment needs to establish whether its systems are exposed and take the appropriate action. This does not mean, however, every website using PHP has been compromised, or that every PHP-based platform is inherently insecure. The immediate risk depends on factors including the software and version in use, the server configuration, available security updates and whether appropriate mitigations are in place.

The wider lesson, however, is difficult to ignore beacuse organisations are not only responsible for the website they can see, they also depend on the software, infrastructure and third-party components operating behind it.

WordPress is not the whole story

WordPress began as a blogging platform and has grown into one of the world's most widely used content management systems. Its accessibility, extensive plugin ecosystem and large community have made it an attractive choice for organisations of all sizes. There are legitimate reasons for that popularity, as WordPress can provide a practical way to publish and maintain website content without requiring specialist development for every change. But a platform that makes publishing straightforward does not automatically make the underlying service straightforward to secure.

WordPress websites depend on PHP, alongside a database, a web server and potentially a wide range of themes, plugins and other extensions, where each component has its own maintenance requirements and security considerations. The more components an organisation relies on, the more important it becomes to understand who is responsible for maintaining them and how quickly problems can be addressed. This does not make PHP or WordPress inherently insecure - a website developed using a PHP stack can be secure when it is properly designed, configured and maintained, with appropriate security measures in place. The same is true of WordPress when it is managed responsibly.

Equally, a website can look polished, perform well and be easy to update while still depending on software that is outdated, unsupported or inadequately maintained. A different platform does not automatically offer better protection.

The concern is not simply whether an organisation uses WordPress, it is whether the technology has been chosen appropriately, whether its dependencies are understood and whether there is a clear plan for keeping the service secure throughout its lifetime.

Why public bodies should look more closely

Websites operated by schools, councils and other public bodies are often treated primarily as publishing channels, but in reality, they can be an important part of how an organisation communicates with the public, shares information and provides access to services. An interruption can create immediate practical difficulties and a security incident can have more serious consequences, depending on the systems involved and the information they hold.

Public bodies therefore need to consider more than the initial cost of a website or the convenience of its content management system, they also need to understand the security arrangements, maintenance commitments and technical dependencies that come with it.

That includes asking some straightforward questions:

• Who is responsible for updating the underlying PHP environment and how quickly can critical fixes be applied?
• Are themes, plugins and other third-party components actively maintained and supported?
• How are vulnerabilities identified, assessed and prioritised?
• Is there a clear process for investigating suspicious activity and responding to a potential compromise?
• Can the organisation recover its website and data if a serious incident occurs?
• Is the platform still appropriate for the purpose it serves, or has it accumulated years of extensions and dependencies without a wider review?

These are not questions that need to wait for an incident, they should form part of the original procurement decision and the ongoing management of the service.

Security is an ongoing responsibility

No widely used technology is entirely free from vulnerabilities, critical security issues can affect established platforms, specialist software and custom-developed applications alike. Choosing an alternative to WordPress does not remove the need for updates, monitoring, testing and responsible maintenance. The important distinction is how a system is designed and managed, how well its operation is understood and how readily those responsible can respond when something goes wrong.

When a critical vulnerability emerges, applying the available patch is essential and depending on the circumstances, organisations may also need to investigate potential exploitation, review logs, assess whether information has been accessed and take further steps to secure affected systems.

Security is therefore not simply a matter of installing an update when one becomes available, it requires an ongoing process, with clear responsibilities and the ability to act when circumstances change.

This is particularly relevant when a website has become essential to everyday operations, as technology choices made to meet an immediate budget or publishing requirement can remain in place for years, long after the original assumptions have changed.

A sensible approach begins with understanding the purpose of the service, the risks associated with it and the resources available to maintain it. It also means looking beyond the visible interface and considering the entire technical arrangement that keeps the website running.

A better question to ask

The events of 21st October are a reminder that the security of a website cannot be judged by its appearance, its popularity or the reputation of the platform on which it runs.

For schools and public bodies reviewing their digital services, the more useful question is not simply whether a website is working today, iIt is whether the organisation understands what it depends on, who is accountable for keeping it secure and whether those arrangements remain suitable over time.

These decisions are less visible than a new website launch, they are also among the most important decisions an organisation can make about its digital services.

Organisations responsible for PHP-based systems should consult the latest official PHP security advisories and guidance from the relevant national cybersecurity authority. The UK National Cyber Security Centre's advice on the October 2026 vulnerabilities is available on its website.

References:

UK National Cyber Security Centre: Critical security issue affecting PHP

Official PHP security announcements

WordPress.org: Critical PHP security release