(CNS): The UK’s National Cyber Security Centre published an alert on 21 October about critical vulnerabilities affecting PHP, a software used by many websites and online applications worldwide. However, a security update to address them has been released.
The NCSC has advised all organisations using PHP to assess their exposure, regardless of version. A release from the Cayman Islands Government said the Cyber Security Unit and relevant departments are reviewing the local digital environment for vulnerable systems and are taking appropriate action, though the government overall is not directly impacted.
GOV.KY and myegov.ky operate on a platform which does not use PHP, the release noted.
The vulnerabilities were apparently discovered by artificial intelligence agents. In a blog post, OpenAI said it had led researchers, security providers and others to address vulnerabilities in PHP over the past two months, and called the flaws “one of the most impactful security issues in recent memory”.
OpenAI’s revelation sparked global concern because of the widespread use of the PHP software all over the world. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could allow an attacker to run commands remotely on a web server running PHP without needing to log in.
“These vulnerabilities therefore do not directly affect the underlying platform. Other systems and services require individual assessment, and our teams are assessing exposure across other government systems and ensuring appropriate protective measures are taken,” the release stated.
“This work follows the priority guidance issued by the NCSC and the PHP Foundation, including identifying systems that run PHP, applying available security updates and mitigations, and monitoring for signs of compromise.”
Cyber security readiness requires continuous attention, the CIG said. This means identifying risks, updating systems, preparing to respond to incidents and helping people make informed decisions online. No jurisdiction can eliminate every cyber risk, but government, businesses and residents each have a role in strengthening Cayman’s resilience, the CIG said.
That shared responsibility is central to the CIG’s Cyber Safe public education campaign, which provides practical guidance to help residents recognise suspicious requests, protect their accounts and know what to do if they believe they have been targeted.
Government officials advise residents and businesses to ask IT teams or their hosting provider whether their systems use PHP and to confirm that the necessary security updates have been applied. This technical work must be handled by those responsible for maintaining the systems.
For more information, visit the NCSC or gov.ky/cybersafe.