Summary

  • Ofcom urged communications providers and essential digital-infrastructure operators to act on the NCSC's warning about two critical PHP vulnerabilities.
  • The regulator will speak with supervised services over the coming days and weeks about remediation under their regulatory duties. The PHP project has shipped fixed releases.

The web team may have found the patch first. The telecom supervisor has now found the question it raises. In a 23 October notice, Ofcom urged all communications providers and Operators of Essential Services in the digital infrastructure subsector to give urgent consideration to UK cyber agency guidance on newly discovered PHP flaws. It will engage supervised services in the days and weeks ahead to understand how they are remediating them in the context of their regulatory duties.

The National Cyber Security Centre alert identifies CVE-2026-109618 and CVE-2026-109619. One involves out-of-memory handling that can corrupt partially initialized request data; the other can leave request-owned state alive after its backing memory has been freed. Under certain conditions, the resulting corruption can permit unauthenticated remote code execution. PHP is commonly associated with websites, but its server-side code also sits inside the interfaces and supporting systems used by networked services. An operator needs a map of those dependencies before it can know the size of the job.

The PHP project's security release lists fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It warns that web-request installations across several server setups are in scope, with particular concern for Apache mod_php. Distributions and long-term-support vendors may provide backported packages. The number printed by php -v is therefore only the start of the inventory; the package supplier and deployed fix matter too.

NCSC's sequence is practical: find PHP everywhere, put internet-facing systems first, install fixed software, and use the published temporary measures if an immediate update is impossible. Where neither update nor mitigation can be applied promptly, it advises considering taking the system offline. Where a service cannot be updated or disabled immediately, it advises examining it for evidence of compromise before the change. That sequence connects vulnerability work to availability choices a communications provider must make in public.

Ofcom's contribution is the handoff from security bulletin to supervised operation. It has announced conversations about remediation, not a list of companies or a result. The useful question for each operator is brutally ordinary: which systems run PHP, which fix did they receive, and who made the decision for the ones still exposed?