Dorset Council: Dorset Council and Museum hit by PHP security update

Dorset Council and Museum Take Systems Offline Following Critical PHP Vulnerabilities

Dorset Council temporarily disabled all electronic forms and select applications on its website on October 21 after an urgent security update was issued for PHP, a widely used programming language. A spokesperson confirmed that some services were restored by 3:30 PM, though certain applications remained under maintenance. Residents needing immediate access were directed to contact customer services.

Meanwhile, Dorset Museum & Art Gallery in Dorchester also took its website offline as a precaution, citing the same industry-wide security concerns. The museum clarified that the disruption stemmed from a "serious security flaw in PHP" publicly disclosed earlier that day. While the issue was not specific to the museum, many organizations preemptively disabled systems while applying patches. The museum is working with its web team and hosting provider to restore services safely.

The UK’s National Cyber Security Centre (NCSC) warned of two critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 which could allow unauthenticated attackers to execute commands on vulnerable servers. Both flaws received a 9.2 severity rating from CERT-EU, with fixes released on October 21. The NCSC advised organizations to update PHP immediately or take affected systems offline if updates were not feasible.

Neither Dorset Council nor Dorset Museum & Art Gallery reported any cyberattacks or data breaches linked to the incident. The disruptions reflect broader efforts to mitigate risks associated with the newly disclosed vulnerabilities.

Source: https://www.dorsetecho.co.uk/news/26660519.dorset-council-museum-hit-php-security-update/

Dorset Council TPRM report: https://www.rankiteo.com/company/dorset-council-uk

"id": "dor1792715131",
"linkid": "dorset-council-uk",
"type": "Vulnerability",
"date": "10/2026",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"

{'affected_entities': [{'customers_affected': 'Residents needing immediate '
                                              'access to services',
                        'industry': 'Public Sector',
                        'location': 'Dorset, UK',
                        'name': 'Dorset Council',
                        'type': 'Government'},
                       {'industry': 'Cultural/Heritage',
                        'location': 'Dorchester, UK',
                        'name': 'Dorset Museum & Art Gallery',
                        'type': 'Museum/Art Gallery'}],
 'attack_vector': 'Remote Exploitation',
 'customer_advisories': 'Residents directed to customer services (Dorset '
                        'Council); public statement (Dorset Museum)',
 'date_detected': '2023-10-21',
 'date_publicly_disclosed': '2023-10-21',
 'description': 'Dorset Council temporarily disabled all electronic forms and '
                'select applications on its website after an urgent security '
                'update was issued for PHP. Dorset Museum & Art Gallery also '
                'took its website offline as a precaution due to a serious '
                'security flaw in PHP. The UK’s National Cyber Security Centre '
                '(NCSC) warned of two critical PHP vulnerabilities '
                '(CVE-2026-109618 and CVE-2026-109619) that could allow '
                'unauthenticated attackers to execute commands on vulnerable '
                'servers.',
 'impact': {'downtime': 'Partial (some services restored by 3:30 PM)',
            'operational_impact': 'Temporary disablement of online services',
            'systems_affected': 'Electronic forms and select applications'},
 'investigation_status': 'Ongoing (mitigation in progress)',
 'post_incident_analysis': {'corrective_actions': 'Applied security patches; '
                                                  'restored services after '
                                                  'mitigation',
                            'root_causes': 'Critical PHP vulnerabilities '
                                           '(CVE-2026-109618, '
                                           'CVE-2026-109619)'},
 'recommendations': 'Update PHP immediately or take affected systems offline '
                    'if updates are not feasible',
 'references': [{'source': 'National Cyber Security Centre (NCSC)'},
                {'source': 'CERT-EU'}],
 'response': {'communication_strategy': 'Directing residents to customer '
                                        'services (Dorset Council); public '
                                        'statement (Dorset Museum)',
              'containment_measures': 'Disabled electronic forms and select '
                                      'applications; took websites offline',
              'recovery_measures': 'Restoring services after patching',
              'remediation_measures': 'Applying PHP security patches',
              'third_party_assistance': 'Hosting provider (Dorset Museum)'},
 'stakeholder_advisories': 'NCSC advisory on critical PHP vulnerabilities',
 'title': 'Dorset Council and Museum Take Systems Offline Following Critical '
          'PHP Vulnerabilities',
 'type': 'Vulnerability Mitigation',
 'vulnerability_exploited': ['CVE-2026-109618', 'CVE-2026-109619']}