Summary
- Ofcom's 23 October notice addresses communications providers and regulated essential digital infrastructure operators.
- The regulator urges urgent consideration of NCSC advice on critical PHP vulnerabilities.
- Ofcom will engage supervised services about remediation under existing regulatory duties; it has not announced a new blanket deadline.
Ofcom has asked UK communications providers and regulated operators of essential digital infrastructure to give urgent consideration to government guidance on recently disclosed critical PHP vulnerabilities. The notice brings the technical emergency into the regulator’s ongoing supervision of communications and infrastructure security, rather than introducing a new vulnerability or suggesting that every regulated service has been compromised.
Published on 23 October, the notice refers to advice from the National Cyber Security Centre covering two flaws in the widely used server-side language. Ofcom says it recognises the complexity of remediation for the sector and will engage with supervised services over the coming days and weeks to understand their response in the context of regulatory duties.
The PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, triggered emergency updates on 21 October. They concern memory handling and control-flow failures that can, under vulnerable conditions, permit remote code execution. The potential severity is high, but determining actual exposure requires checking installed PHP versions, server configurations and whether affected applications are reachable by an attacker.
The Ofcom notice focuses on services that support communications and essential digital infrastructure. These organisations can operate interconnected systems, third-party applications, administrative interfaces and services with constraints on downtime. Even a routine software update may require testing and careful scheduling if a failure would interrupt an important customer-facing or operational function.
That operational difficulty does not remove the underlying obligation to manage cyber risk. Ofcom explicitly points to existing regulatory responsibilities, signalling that supervised organisations may be asked to explain the measures they took, the evidence they used to assess exposure and their plans for components that could not immediately be patched.
Ofcom has not announced a separate regulatory patch deadline or said it has opened enforcement proceedings against named providers. Its language calls for urgent consideration of the NCSC’s guidance and anticipates supervisory dialogue. Presenting the notice as a new mandatory 24-hour patch rule would overstate the public record.
For infrastructure operators, the first practical question is whether PHP exists only in public web applications or also within management tools and supplier-managed components. Version information may be absent from a central asset inventory when software is bundled within appliances, bespoke portals or ageing dependencies. Reviewing the original product and supplier documentation can be necessary to distinguish a genuinely exposed instance from an unaffected installation.
Where patching cannot be completed immediately, temporary containment measures may reduce reachable attack surface, but their sufficiency depends on the actual vulnerability and deployment. A web application firewall rule, for example, is not automatically a substitute for fixing a vulnerable runtime. A regulatory assessment would need to consider documented residual risk and confirmation that final remediation has occurred.
The announcement follows separate reporting on precautionary shutdowns of UK government services as authorities responded to PHP2Shell. Those shutdowns are not evidence that the communications networks within Ofcom’s remit have suffered the same outcome. The regulator’s statement does not identify a compromise at any supervised operator.
Ofcom also supervises organisations with different technical environments and obligations. Its willingness to engage services individually recognises that an appropriate recovery programme may vary by asset criticality, vendor support and operating constraints. Nevertheless, delays without an accurate inventory or prioritisation plan can prolong uncertainty about the real level of exposure.
Some network operators may have relatively few direct PHP applications but depend on externally maintained portals for provisioning, customer support or operations. The security of those functions cannot be assumed from a list of public websites alone. Where responsibility sits with a vendor or outsourced operator, a regulated provider may need evidence of versions, controls and remediation from another party. Ofcom’s intended supervisory discussions could therefore involve both an organisation’s own technical teams and its suppliers.
Ofcom has said it will engage with supervised services in the coming days and weeks to understand how vulnerabilities are being remediated under existing regulatory duties. The regulator has not disclosed the number of services affected or the timing of any planned supervisory assessments.
