Is my personal data at risk from the PHP vulnerability?

MacWindowsiPhoneAndroidUpdated

A vulnerability is a weakness, and a weakness on a website isn't the same as your data being taken. PHP2Shell is two critical flaws in PHP, the language many websites run on, fixed on 21 October 2026. The UK's National Cyber Security Centre (NCSC) says they may allow attackers to run commands on web servers using PHP. As of 23 October 2026, no official advisory gives a list of affected companies or customers.

Quick answer

Not necessarily. PHP2Shell is a flaw in web servers, and a server having the flaw doesn't mean anyone's data was taken from it. If a site you use is breached and the risk to you is high, the ICO says the organisation must tell you without undue delay. Meanwhile, use separate passwords, turn on 2-step verification and distrust breach-themed messages.

Does the PHP vulnerability mean my data has been stolen?

No, not on its own. The NCSC describes a data breach as an organisation's information being stolen or accessed without authorisation. PHP2Shell is a weakness that could let someone do that on a server that hasn't been fixed. Whether anything was actually taken from a particular site depends on whether that site was attacked, and that's something only the organisation running it can establish.

What the official sources say so far, as of 23 October 2026:

  • The PHP project released fixed versions on 21 October and told all PHP users to update immediately.
  • The US Cybersecurity and Infrastructure Security Agency (CISA) says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication".

None of those is a statement about any specific shop, bank or service. Our PHP2Shell explainer covers the flaws themselves.

How would I know if a website I use was breached?

The organisation should tell you. The Information Commissioner's Office (ICO), the UK's data protection regulator, says organisations must report a breach to it "where feasible within 72 hours" if it's likely to put people at risk. If the risk to people is high, the organisation must also notify those people without undue delay.

So the normal route is an email, letter or notice from the company itself. That also means a message claiming to be about a breach is exactly what a scammer would send, which is why the next steps matter.

If you think a site you use might be affected, the NCSC suggests contacting the organisation through its official website or social media channels, and not through links or contact details in a message you were sent. Ask whether there was a breach, how you're affected and what else you need to do. The NCSC notes phone lines may be busy after a major breach.

Should I change my password on that site?

Change it if you have a reason to: the company tells you to, or you used that password anywhere else. The NCSC says that if a password you still use turns up in a suspicious message, change it, along with any other account where you've reused it.

  1. Go to the site by typing its address yourself or using its app, not through a link in an email or text.
  2. Change the password in the account's security settings.
  3. Change it anywhere else you used the same one.
  4. Use a strong, separate password for each account. The NCSC suggests three random words, and says a password manager can create and store passwords for you. Where a site offers a passkey, the NCSC says to consider one.

Your email password matters most. The NCSC's top tips start with protecting your email with a strong and separate password.

Should I turn on 2-step verification?

Yes, wherever it's offered. The NCSC says passwords can be stolen even when they're strong, through data breaches, reused passwords and phishing. 2-step verification adds a second check after your password, such as a code sent by text, an authenticator app, or a fingerprint or face scan. The NCSC says it helps keep criminals out of your accounts "even if they know your passwords".

Turn it on for email first, then banking and shopping accounts. For an Apple Account, see two-factor authentication for your Apple Account.

How do I spot scams that use the news?

Expect them. The NCSC says criminals exploit high-profile breaches while they're in the news, even when your details weren't taken. Its guidance describes messages that claim "fraudulent activity has taken place" and ask you to log in and verify your account, with links that can look genuine.

Signs the NCSC lists:

  • official-sounding subjects such as resetting passwords or receiving compensation
  • technical wording
  • pressure to act quickly

The ICO adds that criminals impersonate banks and HMRC. If a call claims to be from your bank, hang up and ring the number on your card, or use the bank's app or website. In the UK, forward a scam email to report@phishing.gov.uk and a scam text to 7726.

What should I check in my accounts?

The NCSC suggests looking for signs that someone else has been in an account: you can't log in, security settings have changed, there are sent messages you don't recognise, or there are logins from odd places or at odd times. If you see any of those, read someone else signed into your account.

The ICO suggests checking your bank statements and getting a copy of your credit report, then contacting your bank, building society or card provider about anything you don't recognise. If you've lost money, the NCSC says to tell your bank and report it to Report Fraud.

More questions

Can I check whether my email address is in a data breach?

The NCSC suggests tools such as haveibeenpwned.com, or similar features in password managers and antivirus products, to see whether your details appear in public breaches. A result there relates to past breaches it knows about, not to PHP2Shell specifically.

Will a company always tell me about a breach?

Not always. The ICO's rule is that organisations must tell affected people without undue delay when the risk to them is high, so a lower-risk breach may not reach you directly. You can always ask the organisation what happened.

How do I complain about how a company handled my data?

Complain to the organisation first. The ICO says the organisation has 30 days to acknowledge your complaint. Keep notes of every contact, and follow up in writing if you spoke by phone. If you're not satisfied, you can complain to the ICO online.

What is Cifas protective registration?

It's a service the ICO suggests considering after a breach. The ICO says protective registration adds a warning flag to your details on the National Fraud Database, so organisations run extra checks when your details are used to apply for something. There is a fee.

Do I need to install anything on my phone or computer?

Not because of PHP2Shell. The flaws are in web servers, which the site's owner updates. The NCSC's general advice is still to install the latest software and app updates on your own devices.

Will my bank ask me to confirm my details because of this?

The NCSC says banks and other official organisations will never ask for personal information. If a message about a breach asks you to log in or confirm details, contact the organisation through its official website or app instead.

Sources