PHP has remained one of the world's most widely used programming languages for decades. The reality is, that if you don’t work in IT, you may never have heard of PHP, yet most of us interact with it in some form every day.
Further to the recent disclosure of PHP vulnerabilities, it’s worth breaking down what PHP is and what risks these reported vulnerabilities may present.
What is PHP?
PHP stands for "PHP: Hypertext Preprocessor". In technical terms, it’s an open-source programming language used to power websites and web-based applications. In simple terms, PHP helps websites process information and generate the content we see.
Widely used since the 90s, PHP remains a component of many websites, online services and applications. Its widespread use means that vulnerabilities affecting PHP are felt on a global scale.
What is the vulnerability?
On 21 October 2026, cybersecurity researchers disclosed vulnerabilities affecting certain versions of PHP that could, potentially, allow cyber attackers to execute malicious code on vulnerable web servers.
These vulnerabilities were identified using AI and while the full impact is still being assessed by IT and security teams worldwide, it is understood that successful exploitation could lead to unauthorised access to systems, service disruption or the compromise of sensitive personal data.
Some commentators suggested that increasingly sophisticated use of AI by threat actors may increase the speed at which vulnerabilities can be identified and exploited.
Who is affected by PHP vulnerabilities?
Many organisations may not yet know whether they are affected by PHP vulnerabilities. While the potential scope of exposure is broad, organisations should not assume they are affected simply because they use PHP-based products.
It’s important to allow your technical teams the opportunity to investigate, with some organisations introducing precautionary measures such as increased monitoring, restricted access to services or temporarily taking websites offline while assessing their exposure and risk.
Why it matters for data protection
From a data protection perspective, the existence of a PHP vulnerability does not, itself, constitute a personal data breach. However, if a vulnerability results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, a personal data breach may have occurred within the meaning of UK GDPR.
Assessments should be conducted on a case-by-case basis, taking into account the systems affected, the personal data involved and the potential impact on individuals. Organisations should assess exposure, monitor for signs of compromise and maintain clear records of decisions, findings and remedial actions.
Steps to take now, if you think your organisation may be affected
- Identify exposure: Determine whether your websites and applications use PHP, directly or as an embedded component.
- Implement technical mitigations: Follow National Cyber Security Centre (NCSC) guidance by updating PHP to the latest supported version where possible and, where immediate patching is not feasible, implement appropriate mitigating controls to reduce the risk of exploitation.
- Engage suppliers: Contact software providers, hosting companies and managed service providers to establish whether their products are affected and what remediation steps are being taken. Retain a record of any assurances received.
- Document actions taken: Record all assessments, findings, decisions and remedial actions. This may assist in demonstrating compliance with UK GDPR accountability and breach documentation obligations.
- Assess for personal data breaches: Where there is evidence of compromise, assess whether a personal data breach has occurred and escalate to the Data Protection Officer for consideration of any notification obligations.
- Obtain data processor assurances: Where suppliers process personal data on your behalf, seek written confirmation of their assessment, mitigation measures and remediation activities.
- Review lessons learned: Once the issue has been resolved, review the effectiveness of software inventories, supplier engagement, incident response procedures and patch management processes, and implement any necessary improvements.
Looking ahead
This issue highlights the importance of organisations understanding their technology estate and supply chain. Maintaining an accurate inventory of systems, identifying dependencies on third-party software and obtaining assurances from suppliers can significantly improve an organisation's ability to respond to security risks and demonstrate compliance with regulatory obligations.
As with any developing cybersecurity issue, organisations should rely on information from security teams, suppliers and official security advisories rather than speculation.
If you require support with incident assessment, personal data breach investigations or regulatory notification decisions, please contact the Thorntons Data Protection team.
Related thinking
Cyber-attacks: What can you do to protect your organisation's personal data?
