Charity Websites and the PHP Vulnerability: A Plain-English Guide for Trustees and Volunteers
A lot of charity websites have a similar history. A generous volunteer or a small local agency built the site on WordPress a few years ago, it has taken donations and event bookings ever since, and nobody has thought much about what's running underneath it.
On 21 October 2026, that "underneath" became front-page news. Two serious security flaws in PHP, the software that powers WordPress and most other website platforms, were fixed in an emergency release. Governments in Europe and Canada took their own websites offline while they updated, and attackers started trying to exploit the flaws almost immediately. Our main article covers the detail: PHP2Shell and the Cyber Essentials 14-day patching rule.
This guide is for trustees, chief officers and volunteers who don't speak "IT" but need to know whether their charity is exposed.
In plain terms, what's the risk?
The flaws allow an attacker to take control of a website's server without a password. For a charity, that could mean a defaced website, donors redirected to a fake donation page, supporter details stolen, or the site being used to attack others. Any of those would be a reputational problem long before it became a technical one.
Three things to do this week
1. Find out who looks after your website. It might be a volunteer, an agency or your hosting company. If nobody can say for certain, that's the first job.
2. Ask them one simple question: "Has our website's PHP been updated to a fixed version since 21 October, and can you confirm the date?" The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Many large hosting companies patched customers' servers automatically, but don't assume. Get it confirmed.
3. Ask what version you were on before. If the answer is PHP 8.1 or older, your site was running software that may not get a fix at all. That needs an upgrade plan, and possibly a conversation about whether the site needs rebuilding.
A question for the trustee board
Who in your charity can authorise taking the website offline at short notice if something like this happens again? When PHP2Shell hit, the UK's NCSC advised organisations that couldn't update quickly to consider taking systems offline. That's a much easier decision if it has been agreed in advance, and if your donations and bookings have a fallback.
How Cyber Essentials fits in
Cyber Essentials is the UK government-backed baseline for cyber security, and it's designed to be achievable for small organisations without a dedicated IT team. One of its five controls is keeping software updated: high and critical security updates must be applied within 14 days of release, and software that's no longer supported must be removed.
Fourteen days is the maximum the scheme allows. Our advice is to treat 7 days as the normal target, and hours for anything that's being actively attacked on your website.
The Cyber Essentials benefits for a charity go beyond security. A certificate reassures funders, partners and supporters that you take care of the data they trust you with, and it gives trustees a clear, independent check on something they're ultimately accountable for.
Getting started
If you're wondering how to get Cyber Essentials when your IT is looked after by volunteers, our Supported service gives you an assessor who explains every question in plain English and checks your answers before anything is submitted. You'll find more charity-focused guidance in our charities resources, or call us on 0333 339 0383.
Comments