Cyber Security Notice for AXREM Members and the Wider Healthcare Technology Community 

AXREM has been made aware of an emerging cyber security concern relating to newly disclosed critical vulnerabilities affecting PHP, one of the world’s most widely used web technologies. Security agencies and cyber experts have warned that these vulnerabilities could potentially enable unauthorised access to affected web servers if left unpatched.

Given the widespread use of PHP across websites, customer portals, service applications and connected business systems, organisations are encouraged to review their exposure and ensure appropriate mitigations are in place. Cyber security authorities, including the NSA, CISA and CERT-EU, have advised organisations to urgently identify affected systems, apply vendor patches, and closely monitor internet-facing services.

✅ Conduct an immediate inventory of systems and services that rely on PHP.
✅ Apply vendor-released security updates as a priority, particularly for internet-facing platforms.
✅ Review monitoring and logging capabilities to detect unusual activity.
✅ Engage with your IT and cyber security teams to assess organisational exposure.
✅ Consider additional mitigations or temporary isolation of vulnerable systems where immediate patching is not possible.

AXREM has been advised that NHS Trust and NHS Supply Chain is working with its cyber security and supplier assurance teams to understand any potential risks to the healthcare supply chain and continuity of supply, further communications are expected.

We encourage members to engage with their relevant cyber security, IT and compliance teams now so they are prepared to respond promptly when further communications are issued.

Cyber resilience is a shared responsibility across our sector. Timely awareness, robust patch management and proactive engagement remain essential to protecting healthcare services, patients and critical infrastructure.