Recent headlines about PHP have triggered a global response from organisations rushing to understand it and act.
At a glance
The PHP vulnerability highlights visibility and preparedness as core business resilience challenges. Organisations must identify exposure across internal systems and suppliers, remediate quickly, and maintain critical services.
The affected PHP versions may exist in websites, applications, and supplier-managed services across many sectors.
During the first 24 to 48 hours, organisations should find internet-facing systems, patch them, contain unprotected services, and check for compromise.
Boards and executives should demand evidence of supplier remediation, understand operational and regulatory impacts, and test continuity plans for critical-service disruption.
What the PHP vulnerability means for organisations
The recent PHP incident attracted significant attention because it affects the PHP interpreter itself rather than a single application or software product. PHP sits behind millions of websites, applications and digital services worldwide, including many platforms organisations rely on every day. Products built on WordPress, Drupal, Magento and a range of supplier-managed services may all be affected.
What makes this incident particularly significant is the scale of potential exposure. Unlike vulnerabilities that are limited to a specific vendor or application, these flaws affect technology that sits deep within many organisations' digital estates and supply chains.
"Many organisations will be told they don't use PHP, and that may be true within their own environment. The more important question is whether a critical system or supplier relies on it and whether the right action has been taken. That's why visibility and supplier assurance are so important."
While emergency patches have been released, the story is unlikely to end once systems are updated. Organisations will continue assessing whether vulnerable systems were exposed before patches became available, looking for signs of compromise and seeking assurance from suppliers over the coming weeks and months.
In that sense, the lasting impact may not be the vulnerability itself. It may be the reminder that organisations cannot protect what they do not know they have and cannot manage risks they cannot see.
Who is most at risk?
The short answer is any organisation that relies on websites, customer portals, digital services or third-party technology providers.
While no sector is immune, organisations with large online footprints or complex supplier ecosystems are likely to face the biggest challenge. That includes financial services, retail, healthcare, higher education, local government, charities and professional services organisations that depend on externally hosted websites, customer platforms and cloud-based applications.
The organisations that should be asking the most questions are often those with technology that's been around the longest. There is a real possibility that vulnerabilities exist within websites, applications or supplier-managed services that haven't attracted much attention in years. The challenge isn't always finding the patch. It's finding the system that needs it.
Navigating the PHP crisis: What should organisations do right now?
For organisations that discover they are running affected versions of PHP, the priority is to establish where exposure exists, apply available patches and understand whether any systems may already have been compromised. The window between disclosure and exploitation attempts was measured in hours rather than weeks, which means speed matters.
The first 24 to 48 hours should focus on four actions:
1. Find it
Identify all internet-facing PHP systems, including supplier-hosted and externally managed services.
2. Patch it
Update affected systems as quickly as possible and obtain assurance from suppliers that remediation has been completed.
3. Contain it
If appropriate protections cannot be implemented quickly, restrict access to vulnerable systems or consider taking affected services offline.
4. Check it
Look for signs of compromise and assess whether credentials, secrets or sensitive data may have been exposed.
From cyber security to operational resilience
Although PHP is a technical vulnerability, its implications extend well beyond the IT function.
"What's often overlooked is that this is not just an IT issue. It is a resilience and business continuity challenge. In our work helping clients strengthen operational resilience and define their Minimum Viable Business, we see the importance of understanding critical dependencies and having clear visibility of exposure across the organisation and its supply chain. The organisations that respond best are those that can quickly obtain assurance from third parties and maintain critical operations while remediation takes place."
When does this become a board-level issue?
The answer is simple: when it has the potential to disrupt services, expose data, impact revenue, create regulatory obligations or damage trust.
For boards and executive teams, the most important questions are often not technical. A vulnerability affecting a supplier can quickly become an operational, regulatory and reputational risk for the customer. And the consequences are not measured solely in reputational damage, for many organisations, digital services are critical revenue streams. If a website, ecommerce platform or customer portal needs to be taken offline while a vulnerability is investigated or remediated, the impact can be felt immediately in lost income and increased costs. In a challenging economic environment, resilience is not simply about recovering from incidents. It is about reducing the financial impact when they occur.
Boards therefore need evidence that critical providers have identified affected systems, completed remediation and checked for signs of compromise.
Do we understand our exposure?
Can we identify affected systems across our organisation and our supplier ecosystem?
Are we confident the risk is being managed?
Have patches been applied, appropriate mitigations implemented and assurance received from critical suppliers?
Could we continue operating if a critical system or supplier was affected?
Do we understand the operational, customer, financial and regulatory impact, and are our resilience plans ready if disruption occurs?
For boards and non-executive directors
How significant is our exposure and how confident are we in that assessment?
What evidence have we received that critical suppliers have taken appropriate action?
If a critical service was disrupted tomorrow, what would the impact be on customers, operations, finance and our reputation?
For CEOs and executive leadership teams
CEOs should focus on business continuity and resilience:
Could this disrupt our ability to deliver critical services?
Do we understand our most important technology and supplier dependencies?
Are we receiving clear, timely information to make decisions if the situation escalates?
For CFOs
CFOs should focus on financial and regulatory exposure:
What is the potential financial impact of disruption to critical systems or services?
Could this create regulatory, contractual or reporting obligations?
Have we allocated sufficient resources to respond, recover and strengthen resilience?
For CIOs, CISOs and IT leaders
Technology leaders should focus on remediation and assurance:
Have all affected systems been identified and patched?
What evidence do we have that systems have not been compromised?
Have suppliers, hosting providers and technology partners confirmed remediation?
What does the AI element tell us?
One of the more interesting aspects of this incident is the reported role AI played in identifying vulnerabilities that had remained undiscovered for years.
The bigger lesson is that cyber security is becoming a race against time. As highlighted in our recent cyber report, attackers have often been quicker to adopt emerging technologies than the organisations they target. However, AI is now accelerating how quickly vulnerabilities can be identified, analysed and understood. That creates obvious benefits for defenders, but it also increases the pressure on organisations to understand their exposure and respond before vulnerabilities can be exploited.
"This won't be the last vulnerability of this scale and complexity. In many ways, it reflects the new normal in cyber security. The organisations that respond most effectively will be those that can quickly understand their exposure, make informed decisions and act at pace."
This is bigger than cyber security
The PHP vulnerability will eventually be patched. What matters most is how organisations prepare for the next incident.
While the headlines have focused on a technical flaw, the wider issue is organisational resilience. Incidents like this are a real test of how well leaders understand their own organisation, from critical systems and services to supplier dependencies and operational risks. They expose the gaps between what organisations think they know and what they can evidence under pressure.
As cyber risks evolve and vulnerabilities are discovered at an ever-increasing pace, resilience is becoming a competitive advantage. The organisations best placed to respond are not necessarily those with the most technology controls, but those with the visibility, governance and readiness to make informed decisions and maintain critical services when disruption occurs.
Ultimately, this is not a test of technology, it is a test of preparedness.
