The founding head of Britain’s National Cyber Security Centre called it “very, very bad”. We kept calm and patched on.
On 21 October 2026, the developers of PHP rushed out emergency fixes for two critical security flaws, together known as “PHP2Shell”. PHP powers around 70% of all websites that use a server-side language, and these flaws allowed an attacker to take control of a web server without a password or a login. Both were rated 9.2 out of 10 for severity. Technical details had leaked online the day before, and security firms were already reporting attack attempts.
The NCSC sounds the alarm
The UK’s National Cyber Security Centre issued an urgent alert, “Critical security issue affecting PHP”, encouraging UK organisations to take immediate action: update at once, check for any sign of compromise, and take systems offline if they could not be patched quickly. Ciaran Martin, the NCSC’s founding head, put it plainly: PHP2Shell “is very, very bad and requires urgent attention”.
Patched within hours, without a single minute when our site was switched off
We follow the UK’s leading security authorities and act immediately. Although this vulnerability put around 70% of the world’s websites at risk, we applied the security patch within hours of the threat being announced, without taking our website offline. Our web servers install critical security fixes automatically, and the fix was already running on them by 7:30 a.m. UK time on 22 October, before most of the country had reached their desks. Our team then went through every remaining system by hand that same morning, so every server that runs our website or holds your orders and documents is protected.
Checked for intruders, as the NCSC advised
The NCSC also asked organisations to look for signs of compromise, including hidden backdoors. We did exactly that: we searched our servers for altered files, hidden scripts, unknown programs and unexpected access keys, and found none. Challenge resolved.
Your personal data, protected
Every day, clients across the UK trust us with passports, birth and marriage certificates, court papers, medical records and Home Office paperwork. Protecting that personal data is a legal duty under UK GDPR, and one we take very seriously. Your documents are safe with us.
A 9.2 out of 10 threat, resolved. We are protected. Our clients are protected.
If you have any questions about how we look after your documents, our team will be glad to help by phone on 0333 772 1444, by email or on live chat.
