An NHS cyber alert lands in your inbox. You already have a practice to run. What you need is a clear answer: does this affect our website, has it been fixed, and do we need to do anything?
Here is what Tree View Designs has done following the PHP security alert — and what to ask your website provider if your practice is looked after by someone else.
What was the PHP security alert about?
PHP is software that runs behind the scenes on many websites. On 21 October 2026, the PHP project released fixes for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. These could allow an attacker to run code on an affected server without logging in.
NHS England’s alert CC-4875, “Critical Vulnerabilities in PHP (PHP2Shell)”, asked affected organisations to apply a fixed version. That is why practice teams have been receiving requests for supplier confirmation.
We were tracking it before the fix was released
Our team was following the PHP security team’s pre-announcement on 20 October. Core was running PHP 8.4.26, which was affected. We did not wait for a practice to forward an NHS alert before looking at our systems.
-
20 OCTOBER · MONITORING
Alert tracked. Our systems assessed.
We identified Core as affected and followed the forthcoming security release.
-
21 OCTOBER · PATCHING
Fixed on the day of release.
We installed PHP 8.4.27 across every Core production server and restarted the PHP service.
-
21 OCTOBER · VERIFICATION
Checked where it matters: the running service.
We confirmed that website requests were using the updated software.
What did we actually check?
Installing a package is only part of the job. A service can still be using the old software in memory. We checked both the installed files and the service handling website requests.
- Installed packages
- Every installed PHP 8.4 package confirmed at 8.4.27.
- PHP service
- The PHP-FPM binary checked and the service restarted.
- Running processes
- No process still holding the replaced binary in memory.
- Website requests
- nginx routing requests to the updated PHP 8.4 service.
We applied the fix itself. The official PHP advisory confirms that updating is the complete solution for these vulnerabilities; a temporary workaround is not a substitute.
Already a Tree View Designs customer?
You do not need to install anything or change any settings for your Core website. If your IT team, ICB or health board needs evidence, share our written security confirmation. It sets out the completion date, fixed version and verification checks.
Send any questionnaire or specific service-impact questions to our support team. We can answer the actual request so you do not have to interpret a technical advisory.
With another website provider?
Four questions. Clear answers.
You can send these questions to your provider. Ask for confirmation that the work is complete, including the checks below.
-
Was our service affected?
Does the service we use contain an affected version of PHP?
-
Has the fix been applied?
Which fixed version is now in use, and when was the update completed?
-
Has it been verified?
Have you checked that the running service is using the fixed version?
-
What does our practice need to know?
Is there any action we need to take, or any service impact to be aware of?
Our confirmation covers Core, not separate services from other suppliers. The National Cyber Security Centre’s guidance recommends identifying PHP across your systems and following supplier updates. Your IT team can coordinate those checks.
Two useful distinctions
Custom-built still needs care.
Core does not use WordPress, but that does not make it immune to a PHP vulnerability. This alert concerned software underneath the application.
An alert is not proof of a breach.
A vulnerability is a weakness that could be exploited. An alert alone does not establish a compromise; patching is not a guarantee against every future risk.
Security work should not start with your helpdesk ticket
It is entirely reasonable to ask for reassurance. The monitoring, patching and verification should already be part of looking after your website. We tracked this announcement, applied the fix on release day and verified it across every Core production server. We continue to monitor security advisories and apply updates as they are released.
If you are reviewing how your practice website is supported, read how we look after website security or talk to our team about your practice website.
Information checked: 22 October 2026. This article covers CVE-2026-109618 and CVE-2026-109619 and our Core website platform.
