Global website security alert highlights importance of digital preparedness

Two critical security flaws affecting software used by millions of websites have prompted emergency warnings from cybersecurity authorities and led some organisations to temporarily suspend online services.

The vulnerabilities affect PHP, a programming language used by websites and online applications, including platforms such as WordPress, Drupal and Joomla.

The UK’s National Cyber Security Centre (NCSC) has urged organisations using PHP to update their systems immediately. Where this is not possible, it has advised considering taking affected systems offline until they can be secured.

The incident is also a reminder of how dependent everyday life has become on digital services, and why preparing for temporary website and online service outages is increasingly important.

What has happened?

On 21 October 2026, PHP developers released emergency security updates to address two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.

Both have been given severity scores of 9.2 out of 10. If exploited, they could allow criminals to run malicious commands on affected servers or access sensitive information.

Cybersecurity researchers say the flaws could potentially affect a substantial proportion of the internet because PHP is so widely used. However, this does not mean that every website is compromised or that the entire internet is at risk of shutting down.

Some organisations have temporarily suspended websites and online services while applying security updates.

Websites and online services disrupted worldwide

The security alert has prompted precautionary action in several countries.

Government websites in parts of Europe were temporarily taken offline, while organisations in Japan and elsewhere restricted some online services while checking their systems.

According to Reuters, companies and governments have been racing to install security fixes following reports of millions of attempted attacks.

The incident demonstrates how vulnerabilities in widely used software can have consequences far beyond the technology industry, potentially affecting public services, businesses and the websites people rely on for information.

Why this matters for preparedness

For most households, the immediate concern is not the technical details of PHP, but what happens when an essential online service becomes unavailable.

Banking, travel information, government services, healthcare systems and online shopping all depend on digital infrastructure.

An outage may last only a short time, but it can still cause inconvenience, particularly if someone needs urgent information, access to an account or a service they normally use online.

Digital preparedness is therefore becoming an important part of household resilience, alongside more familiar preparations for power cuts, severe weather and other disruptions.

The lesson is not to expect a widespread internet collapse, but to recognise that individual services can become unavailable with little warning.

Five ways UK households can prepare for digital disruption

1. Keep essential information available offline

Save important telephone numbers, insurance details, emergency contacts and other useful information somewhere accessible without an internet connection. A printed copy can be particularly helpful if a website or mobile application is unavailable.

2. Have an alternative way to access important services

Check whether your bank, utility provider or other essential organisation offers telephone support. Keep official contact numbers handy rather than relying entirely on online accounts.

3. Back up important documents

Maintain secure copies of important household and business documents. Where appropriate, use an encrypted external drive as well as a reputable cloud backup service.

4. Keep devices and software updated

Install security updates on phones, computers and other connected devices. Use strong, unique passwords and enable multi-factor authentication wherever available.

5. Be cautious about messages claiming to offer emergency fixes

Major cybersecurity incidents can provide opportunities for scammers. Avoid unexpected links or attachments claiming that an account or device needs urgent attention. Instead, visit the organisation’s official website or contact it using a trusted number.

These measures are useful for a wide range of digital disruptions, not just the current PHP security alert.

What should website owners do?

The NCSC’s advice is particularly relevant to businesses, charities, community organisations and individuals running their own websites.

Organisations should identify whether their systems use PHP, check for available security updates and contact their hosting provider or website developer where necessary.

NHS England’s cybersecurity alert identifies patched PHP versions and advises affected organisations to update promptly. Older, unsupported PHP versions may require migration to a supported release.

Website owners should not assume that updating WordPress plugins alone will resolve a vulnerability in the underlying PHP software.

A reminder of the importance of digital resilience

The latest security incident shows how a problem in a single widely used technology can have consequences across numerous countries and industries.

For UK households, there is no need for panic or drastic action. However, keeping essential information accessible, maintaining backups and having alternatives to online-only services can make unexpected disruption easier to manage.

Preparedness is not only about having supplies at home. It is also about being able to continue everyday activities when the technology we normally rely on is temporarily unavailable.