The Department of Business, Innovation, Science and Trade (DBIST) has issued an urgent call to take action on a critical cybersecurity issue affecting websites. The message below is from DBIST and should be passed on to the relevant team/supplier managing your website maintenance.

The National Cyber Security Centre (NCSC) is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

Organisations using PHP should identify affected systems and update to the latest fixed version, prioritising internet-facing systems. For detailed advice, please see the NCSC’s guidance on the critical security issue affecting PHP.

Cyber incidents can be reported at an individual or organisational level through the GOV.UK guidance on where to report a cyber incident.. Organisations requiring industry support with incident response can also consult the NCSC’s list of assured Cyber Incident Response providers.

Cyber security is no longer just an IT issue; it is a core business resilience and growth issue. Recent cyber incidents have demonstrated the significant operational, financial and reputational impact that attacks can have on organisations and their supply chains. Acting now can help protect your business, customers, suppliers and the wider sector from an increasingly sophisticated cyber threat.

How can I take action?

We encourage all businesses to take practical steps to strengthen their cyber resilience, in line with the National Cyber Security Centre (NCSC) guidance. These include:

• adopting Cyber Essentials
• signing up to the NCSC's free Early Warning Service
• using the Cyber Action Toolkit
• ensuring senior leaders have appropriate oversight of cyber risk. 

You may also wish to assess your cyber resilience against the NCSC's Cyber Assessment Framework (CAF).  

What level of action is appropriate?

Microbusinesses and sole traders:

• Follow NCSC top tips for staying secure online.
• Report cyber-crime and fraud.
• Use simple cyber-security fundamentals.
• Consider cyber careers and skills opportunities where relevant.
• Use the NCSC Cyber Action Toolkit.

Small and medium-sized enterprises (SMEs):

• obtain Cyber Essentials certification
• use the NCSC Cyber Action Toolkit
• engage with local Cyber Resilience Centres
• sign-up to the NCSC Early Warning Service
• consider cyber insurance
• take advantage of Cyber Essentials-linked insurance offers for organisations with turnover below £20m.

Large businesses and large organisations:

• make cyber risk a board-level priority
• use the Cyber Governance Code of Practice
• assess cyber resilience against the Cyber Assessment Framework (CAF)
• sign up to the NCSC Early Warning Service
• maintain and exercise cyber incident recovery plans
• consider stronger assurance measures such as Cyber Essentials Plus and wider supply-chain assurance.

We welcome your feedback

We would be grateful for feedback on your organisation’s current use of NCSC tools and the practical steps you have taken, or plan to take, to improve your cyber security and resilience.

We would also welcome views on any barriers or challenges you have encountered, and areas where further government support would be helpful.

Please send responses to FPBS@businessandtrade.gov.uk by close of play on Friday, 6 November.

Message from ACCA

Cybersecurity threats are on the increase and accountancy practices are especially vulnerable to such attacks as they hold sensitive and confidential financial data of their clients. Members should ensure their teams are fully trained on cybersecurity awareness and remain vigilant to attempted threats and attacks. The following resources should help raise awareness.

Cyber threats pose a serious risk; protect your accountancy practice now

How to navigate cyber risks: Mitigate the risks of a serious cyberattack on your practice

Anti-money laundering regulation, data protection and cyber security | ACCA Global