A critical security vulnerability has been identified in PHP Hypertext Preprocessor (PHP), a technology commonly used to build and operate websites.

The National Cyber Security Centre is advising organisations that use PHP-powered websites to take action to mitigate this security risk. Security updates are available to address the vulnerability.

Actions for practices with a website

• Contact your website developer, website hosting provider or the company that manages your practice website as soon as possible.
• Ask them to check whether your website uses PHP and, if so, ensure it has been updated to a secure and supported version and that the relevant security updates have been applied.
• If you purchase any other website or web-based services from an external supplier, please forward this notification to that supplier and ask them to confirm that any affected services have been appropriately updated and secured.
• You do not need to make technical changes to the website yourself. The website developer or supplier should be able to carry out the required checks and updates.

Practices should treat this as a priority and seek confirmation from their supplier that appropriate action has been taken.
 
Further information and remediation guidance is available from:

• PHP: Hypertext Preprocessor website
• National Cyber Security Centre website.