PHP security alert: VerseOne statement | News

Summary

Your VerseOne services are not affected by the PHP security vulnerabilities announced on 21st October 2026. Every VerseOne solution runs on our own digital experience platform, the VerseOne DXP, which does not use PHP (nor any software based on it, e.g. WordPress, Drupal, etc.). No action is needed on your VerseOne services in response to this alert.

On 21st October 2026, the National Cyber Security Centre (NCSC) urged organisations to address two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell”. Under certain conditions, these flaws could allow an attacker to run commands on an affected web server without logging in. Security updates are available.

Why VerseOne is not affected

These vulnerabilities affect PHP, not digital experience platforms as a category. The VerseOne DXP does not run on PHP, so it is not affected by these specific flaws. This reassurance relates to the VerseOne services described above, not to other systems your organisation may use.

How we watch for security risks

Our Development and Security Teams monitor international vulnerability databases, including the CVE programme, and our assets are registered with the NCSC's Early Warning service. These sources help us identify and assess emerging risks.

We apply security updates to our infrastructure and architecture at least quarterly, and within 72 hours for high-risk issues. Updates are tested before deployment across customer services to reduce the risk of disruption.

Security is continuous work, supported by our independently assessed Cyber Essentials and ISO 27001 certifications.

What we recommend for your other systems

Other websites, applications or equipment used by your organisation may depend on PHP, even if your main website does not. Ask your IT team or supplier to assess those systems using the NCSC's PHP security guidance. The FAQs below explain what to check.

Contact us

For questions about your VerseOne services or a formal statement for your IT, information governance or supplier assurance records, contact your account manager or info@verseone.com.

Frequently asked questions

What is PHP, and how is it different from WordPress or a DXP?

PHP is a programming language used to run websites and applications on a web server. WordPress is a content management system built using PHP. DXP means digital experience platform: it describes a platform's purpose, not the technology it uses. Whether a platform is affected depends on its underlying technology; the VerseOne DXP uses neither PHP nor WordPress.

Is PHP2Shell a WordPress vulnerability?

The vulnerabilities are in PHP itself, rather than WordPress. They can therefore affect WordPress and other applications running a vulnerable PHP version, including Drupal, Joomla and Magento. Updating an application or its plugins is not a substitute for addressing the underlying PHP installation; your hosting provider or server administrator should confirm that the relevant fix has been applied.

Which versions of PHP are affected?

The fixed releases published on 21st October 2026 are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organisations using earlier releases should follow the PHP team's and their supplier's guidance to move to a fixed, supported version. Check the official PHP security advisories for current details rather than relying on version numbers on this page alone.

Does a website being taken offline mean it has been attacked?

No. Taking a system offline can be a precaution while security updates are applied. The NCSC advises organisations to consider this if they cannot update or apply temporary mitigations quickly. An outage alone is not evidence of a breach.

How can I check whether other systems in my organisation use PHP?

Ask your IT team, hosting provider or software supplier to confirm whether each service uses PHP and whether a relevant security update has been applied. Include intranets, microsites, booking systems, hosting control panels and third-party products or equipment that may bundle PHP. Start with internet-facing systems; do not assume a product is unaffected simply because PHP is not mentioned in its name.

What should my IT team do?

Follow the NCSC's current guidance and the relevant supplier's advice. The priorities are:

1. Identify PHP installations, prioritising internet-facing systems, and monitor suppliers for updates to products that include PHP.
2. Apply the relevant PHP security updates and follow the PHP team's additional hardening guidance.
3. If updating immediately is not possible, follow the official temporary mitigation advice. If those measures cannot be applied promptly, consider taking the affected system offline until it can be mitigated.
4. If a system cannot be updated or disabled immediately, assess it for evidence of compromise before upgrading or applying mitigations.

Can VerseOne provide a statement for our supplier assurance records?

Yes. Ask your account manager or email compliance@verseone.com to request a formal statement for your IT, information governance or supplier assurance records.

I'm not a VerseOne customer. Can you still help?

Not directly — we cannot secure or update a website we do not manage. But if your website is vulnerable, you're welcome to contact us. Keeping essential digital services available matters to everyone who relies on them. Our experts can talk through your concerns, offer practical guidance and help you understand your options. Email info@verseone.com to start a conversation.

Where can I find official information?

• NCSC alert: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
• PHP security advisories: https://github.com/php/php-src/security/advisories
• CVE records: https://www.cve.org/