Global IT security risk - should Fife organisations be concerned?

On 21 October 2026, urgent security fixes were released for PHP, a piece of software that runs behind the scenes on roughly seven in ten websites worldwide, including most WordPress sites. The flaw, referred to as PHP2Shell, lets an attacker take control of a web server without needing a password. Attackers started trying to use it within hours of the announcement, so this is worth dealing with this week rather than next month.

You do not need to understand PHP, and you should not try to fix anything yourself. The fix has to be installed by whoever runs the computer your website runs on. This guide should help you work out who that is and gives you suggested words to send them.

The important difference. A website that uses PHP is not necessarily in danger. Most large hosting companies applied the fix within a day or two. The question is simply whether your site has had it. Only the company or person who hosts your website can tell you that for certain.

Why it matters to trustees. If an attacker gets in, they could change what your site shows, use it to send spam or spread viruses, or read anything stored on that server, which may include personal data about staff, members or service users. That is why asking the question is a governance task, not just a technical one.

PHP has since reported a third, much narrower issue (CVE-2026-115560) that it describes as unlikely to affect real websites and will fix in a routine update. It does not change anything on this page.

Start here: who looks after your website?

The one thing you need to find out is who runs the computer your website lives on. That is usually a hosting company, a web developer, or a website-builder service. Three quick ways to find out:

1. Look at where you log in to change text, photos or events. The name on that screen (WordPress, Wix, Squarespace, Joomla and so on) is your platform.
2. Check your invoices and e-mails for a company you pay each month or year for “hosting”, “web hosting” or “website maintenance”. That is probably your host.
3. Ask the person who built the site, or whoever looked after it before. Even a volunteer who set it up years ago will usually know where it is hosted.

Two things that trip people up:

• The company you bought your web address (domain name, e.g. fva.org) from is not always the company that hosts the website. If in doubt, ask either one; they can tell you where the site actually points.
• “WordPress” is the software; “WordPress.com” is one particular company that hosts it. Many charities have WordPress sites hosted somewhere else entirely. If you use WordPress and do not know where it is hosted, that is the first thing to ask.

For WordPress users only: a useful clue. If you can log in to your WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. The “PHP version” shown there is worth passing on to your host. A number starting 8.1, 8.0 or 7 means the site is on an old version with no official fix, so ask urgently. A newer number is encouraging but is not proof the fix has been applied; some hosts install it without changing the number. Either way, send the e-mail below.

Follow this quick decision tree

Whichever route you take, the job is the same: find the person who runs the server and ask them.

Do you recognise your website platform?

Yes, it is a website-builder service

WordPress.com, Wix, Webflow, Squarespace or Shopify

The company runs the whole platform and you cannot install PHP on it, so there is nothing for you to fix on the main site. WordPress.com and Webflow have both confirmed their customers’ sites are protected. Still check any separately hosted tools, as described under “One last check” below.

Is it DigitalFife?  DigitalFife runs predominantly on Microsoft technologies and probably doesn't use pHp.  We're checking that out with them and will update this page when we hear back.

Yes, it is website software I run somewhere else

WordPress hosted with another company, Joomla, Drupal or CiviCRM

Your site uses PHP. Ask your hosting company or web developer to confirm, in writing, that the fix has been applied. Copy the e-mail below.

No, or I am not sure

A bespoke site, or you cannot tell what the platform is

Send the e-mail below to whoever hosts or maintains the site. Ask who hosts it and whether any part of it uses PHP. If you do not know who that is, start with the company you pay for hosting or the person who built the site.

One last check. Donation pages, booking systems, membership databases and e-mail newsletter tools are often separate from your main website and may be hosted by someone else. Ask about those too. For big-name services such as JustGiving or Eventbrite, the provider is responsible for their own fix and you need do nothing; for anything a developer set up for you, include it in your e-mail.

What your website platform means

Find the name you recognise. The platform tells you who should be checking, not whether every connected service is safe.

A note on older websites. If your site was built some years ago and has not been actively maintained, it may be running an old version of PHP (8.1 or earlier). The PHP project has not released fixes for those versions. Your host may have applied its own fix, or may need to move your site to a newer version. Either way, this is the most important thing to ask about, and the e-mail below does so.

Copy this e-mail to your website provider

Send this to your hosting company, web developer or whoever maintains your website. Replace the text in square brackets, then send it. Keep the reply: trustees may want to see it.

Open this e-mail in your mail app (you add the address), or select and copy the text below.

Subject: Urgent: PHP security check for [your website address]

Hello,

I’m writing about the PHP security alert of 21 October 2026 (known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619). Our website is [insert website address].

Could you please confirm the following:

1. Does our website, or any other service you host or maintain for us, use PHP?
2. If so, has the PHP security fix been applied to every one of them? Please confirm this even if the version number shown has not changed, as I understand some providers apply the fix without changing it.
3. Is any of our sites running PHP 8.1 or older? If so, what has been done to protect it, and does it need to be moved to a newer version?
4. Have you checked for any signs of attack or unauthorised access since 20 October?
5. Is there anything you need us to do?

If the fix has not yet been applied, please tell me what is being done to protect the site in the meantime and when it will be done.

I’m not technically experienced, so a short reply in plain English would be very helpful. Given the seriousness of the alert, I’d be grateful for a response as soon as possible.

Many thanks,

[Your name]
[Your role, your organisation]
[Your phone number]

If you get no reply within two working days, chase by phone. If you still hear nothing, or the answer is vague, ask an independent web professional to look at it, or contact FVA for help finding one.

Four things to remember

1. Only your provider can confirm the fix. An online “is my site vulnerable?” checker cannot reliably tell whether PHP is present or whether the fix is in place, and some checkers are themselves scams. Never type passwords or login details into one.
2. Do not try to change PHP settings, versions or website software yourself unless you are the person responsible for maintaining the server. Updating WordPress, a theme or a plugin is good practice but does not fix this problem.
3. If your provider says the site cannot be fixed yet, ask what they are doing to protect it now. The National Cyber Security Centre’s advice is that a system which cannot be fixed or protected should be taken offline until it can. For a charity, that means asking the host to suspend the site temporarily; switching on a “maintenance mode” page inside WordPress does not do the same job.
4. Remember the separate services: donation pages, membership databases, booking forms and newsletter tools. Even if your main site is on a website builder, a developer may have set these up elsewhere.

If something has gone wrong

If your provider finds signs of a break-in, or your site starts behaving oddly (unexpected pages, redirects to other sites, warnings in your browser, e-mails bouncing), treat it as a potential data breach and act the same day:

• Ask the provider to take the site offline and keep any evidence.
• If personal data (members, service users, staff etc.) may have been exposed, you may need to report it to the Information Commissioner’s Office within 72 hours of becoming aware, and tell the people affected.
• Consider whether it is a notifiable event for OSCR, the Scottish charity regulator.
• Report it to Police Scotland on 101 and to the National Cyber Security Centre.
• If your provider cannot help, the NCSC lists assured cyber incident response providers.

Where to find trusted advice

• National Cyber Security Centre: Critical security issue affecting PHP, the official UK alert, updated as the situation develops.
• PHP security advisory, the technical notice for your provider, not for you.
• NCSC guidance for small and medium-sized organisations, good general reading once this is dealt with.

Need help? FVA can talk this through with you and help you find a reputable local web professional. 

Last reviewed: 24 October 2026.

News/Events Categories:

Share your news/events

Sign up to our e-bulletins

Sign up for e-bulletins now