Netcraft/NCSC reaching out to any email address they can find. I host my friend's wordpress blog and he got it to the info@ address as well as me getting it to webmaster@

Issue [#REDACTED]: Potentially vulnerable web application at hxxp://[REDACTED]

Hello,

On behalf of the National Cyber Security Centre (NCSC), we have identified software on your network that may be vulnerable and require remedial action.

The NCSC's mission is to make the UK the safest place to live and work online and as part of its Proactive Notification service, we are writing to alert you to a potential security issue that could be exploited by malicious actors.

This notification is based on our scanning of open-source information, such as publicly available software versions. The service was launched to responsibly report vulnerabilities to system owners to help them protect their services. If you are not the owner of this site, please ensure every effort is made to forward this email onto the webmaster.

The presence of this vulnerability may result in a criminal gaining unauthorised access to, leaking data from or otherwise disrupting your servers. Please follow the remediation steps listed below to address the vulnerability as soon as possible.

* Remote Code Execution in PHP (CVE-2026-109619)

hxxp://[REDACTED] [IP REDACTED]

Your PHP server has two critical remote code execution vulnerabilities (CVE-2026-109618 & CVE-2026-109619).

Successful exploitation could allow an attacker to compromise the server, deploy ransomware, steal data, or attack other machines on the network.

Update your PHP installation to at least one of the following versions immediately:

* 8.5.12

* 8.4.27

* 8.3.36

* 8.2.35

See https://www.php.net/archive/2026.php#2026-10-21-5 for more information about these vulnerabilities. This includes instructions on other measures to reduce your exposure if you can't update immediately.

Sign up for more notifications:

    Every day, UK organisations are targeted by cyber criminals – whether for their data, their funds, or simply to cause disruption. Early Warning is a free service from the NCSC that notifies organisations of potential cyber threats before they cause harm. By signing up, you will receive timely alerts about malicious activity targeting your network – giving you the chance to take action early and reduce risk.

    The more information you share with the NCSC Early Warning service about your IT estate, the more effectively monitoring can be tailored, ensuring you receive relevant, actionable notifications.

    Paste this link in your browser to visit the Early Warning webpage to find out more and to sign up: https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning?referrer=ProactiveNotificationService

    The NCSC website offers a wide range of guidance, tools and services to help organisations strengthen their cyber security. Whether you're a small business, a large enterprise, a charity, or part of the public sector, there is practical advice to help you protect your systems, data and people.

About this email:

    The NCSC has engaged Netcraft to send notifications to organisations identified to be running software with known vulnerabilities, as part of the NCSC's mission to increase the UK's cyber resilience:

    You are ultimately responsible for the security of your own networks and data, and for determining the steps that you take to protect yourself. This includes identifying and addressing vulnerabilities in your systems: this notification service does not cover all systems or vulnerabilities, so you must not rely on it as your sole source of alerts.

    You are also best placed to appreciate the wider implications of our advice for the rest of your business, and it is for you to determine whether and how to implement our recommendations.

    The NCSC processes your personal data in accordance with its privacy policy. For more information and your rights see https://www.ncsc.gov.uk/section/about-this-website/privacy-statement

More information about the detected issue is provided at https://incident.netcraft.com/reports/[REDACTED]
See https://incident.netcraft.com/about for more details including API support.

Kind regards,

Netcraft

Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: [REDACTED]

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: [email protected].