22/10/2026
You may have heard about a critical security issue affecting PHP in the news this week. We're pleased to confirm that our hosting provider installed the patched version of PHP (8.4.27) across its entire infrastructure late yesterday evening. While awaiting the official release, it had also implemented custom mitigations to help reduce any potential risk. We're pleased with how proactively and professionally the situation was handled.
This serves as a timely reminder for all VCSE organisations to review their cyber security arrangements. Even small charities and community groups can be affected by vulnerabilities in widely used software.
A few practical steps:
- Check with your website host or IT provider that all critical security patches have been applied.
- Keep websites, plugins, themes and third-party software up to date.
- Enable multi-factor authentication (MFA) on key accounts.
- Ensure regular backups are being taken and tested.
- Review administrator accounts and remove any that are no longer needed.
- Make sure staff and volunteers know how to recognise and report suspicious activity.
Free UK cyber security support:
- The National Cyber Security Centre (NCSC) offers practical guidance for small organisations and charities: https://ow.ly/J5Rv510065U
- The Cyber Essentials scheme provides a recognised framework for improving cyber security: https://ow.ly/syVr510065V
- If your organisation experiences a significant cyber incident, support and reporting guidance is available through the NCSC and Action Fraud: https://ow.ly/Y0bu510065T
Good cyber security is about more than technology. It's about having robust processes, maintaining good cyber hygiene and working with trusted suppliers who respond quickly when vulnerabilities emerge. For VCSE organisations operating with limited resources, these foundations can make a significant difference.