Reflect on SME management and crisis communication in the disclosure of PHP Vulnerability

💡 This article takes 9 minutes to read

☝️ Key points of this article:

1. Two vulnerabilities related to PHP have been identified.

2. Businesses are required to investigate the impact on their own operations, as well as on their customers and business partners, and to share information.

3. Proactive measures are essential for responding to unexpected incidents.

On October 21, 2026, the PHP Foundation announced several critical vulnerabilities. Under certain conditions, these vulnerabilities could allow unauthenticated third parties to execute commands remotely. Therefore, prompt verification and response are required, along with the release and application of emergency patches. PHP is used widely in the development of websites and web applications. Even businesses that do not develop or manage their own systems may be affected by these issues through the systems or services they use. Based on the disclosure of these vulnerabilities, this article examines small business management and crisis communication (communication following an incident) from a risk management perspective. We will discuss the steps SMEs and sole proprietors can take when facing cybersecurity issues, as well as organizational measures to ensure business continuity.

[Contents]

What has come to light following the recent announcement of the PHP vulnerability?

The Impact of PHP vulnerabilities on SMEs

Crisis management goes beyond technical measures alone

Preparations to make in normal times

Accurately gathering and sharing information even in high-pressure situations

What has come to light following the recent announcement of the PHP vulnerability?

On October 21, 2026, the PHP Foundation announced a critical vulnerability in PHP and released an emergency patch. According to that announcement, a vulnerability was discovered in PHP that could allow remote execution of commands (instructions to perform specific functions) without authentication, and evidence of such attempts has already been confirmed. This issue affects websites and web applications built with PHP, including systems like WordPress, which is commonly used for website development, and has led to various government agencies and companies being impacted or scrambling to address the problem.

PHP is a programming language, and it is said to be used by 70 percent of websites worldwide. Not only is this having a global impact, but there is also a risk that the vulnerability could affect both in-house developed systems and third-party products implemented by your organization. Therefore, it is essential to first verify whether your organization uses any systems built with PHP. You may have already experienced this firsthand. For example, websites you regularly visit may have been temporarily taken offline for emergency maintenance, or you may have received notifications about this from business partners.

The Impact of PHP vulnerabilities on SMEs

Many companies actually use PHP within their organizations to develop websites and web applications, or have implemented such systems. When a critical vulnerability like this is discovered, companies have to address a wide range of risks, from technical tasks such as identifying the scope of the vulnerability, installing emergency patches, checking for unauthorized access, and verifying recovery, to the impact on business operations and corporate reputation. However, to carry out such responses, which require significant staff, time, and cost, relatively quickly, the key is to anticipate potential scenarios from the following perspectives: (1) understanding your company’s situation, (2) the impact of the vulnerability on your business, and (3) response priorities and decision-making procedures, and to proactively organize information and prepare your response in advance.

1. Understanding your company’s situation

When a problem arises with your company’s website, business systems, or the underlying technology, delays in responding may occur if you do not know what systems are in use, where the problem lies, or whom to contact. This is particularly true if system management has been outsourced to a third-party vendor or if the management structure is unclear. Even if management is not directly responsible for technical oversight, it is important to maintain an overview of the management situation.

When a security incident or a vulnerability such as the one described here is discovered, the company faces not only technical consequences such as unauthorized access, data loss, or data tampering, and so on. Also, there are business impacts as described below. These include the risk of damage escalating and recovery costs rising due to delayed response, loss of business opportunities and orders resulting from website or business system downtime, and confusion in internal and external response and communication caused by unclear management arrangements. Therefore, the ideal course of action is as follows:

Compile a list of all websites, business systems, cloud services, and other resources used within the organization.

Clearly identify the internal personnel and external maintenance providers responsible for each system, along with their contact information.

Determine who is responsible for software updates and incident response, and who will verify the status of these tasks.

2. The impact of the vulnerability on your business

Furthermore, while the disclosure of a vulnerability is a serious matter, it does not necessarily mean that your company has immediately suffered damage as a result. Since attackers may quickly exploit disclosed vulnerabilities, it is best to respond promptly. However, to ensure a balanced response with your business operations, it is important to first confirm whether there has been any impact. Without such verification, it is difficult to determine the appropriate course of action. Therefore, it is necessary not only to assess the technical issues but also to evaluate what kind of impact they might have on the business. The following are examples of such impacts:

Loss of trust due to the leakage or tampering of customer or transaction information

Impact on business operations due to the suspension of order processing, reservations, payments, and customer service

Additional work arising from investigation and recovery costs, as well as the need to provide explanations to customers and business partners

Prolonged response times due to delays in assessing the scope of the impact

To minimize losses resulting from these impacts, when information regarding a vulnerability is obtained, you can respond by following procedures such as the following:

1. Verify whether your company’s systems are affected by the discovered vulnerability

2. If affected, assess the likelihood of service interruptions and the scope of impact

3. Identify systems whose downtime would significantly impact business operations, as well as systems that handle customer information and other critical data

4. Collaborate with system administrators and others to categorize and distinguish between technical and business impacts

3. Response priorities and decision-making procedures

The measures described above are ones of the examples. If multiple systems are affected, it may not always be possible to check and correct them all simultaneously, and this issue is likely to be even more pronounced in cases like PHP vulnerabilities issued this month, where the impact was felt simultaneously nationwide and worldwide. Given limited personnel and budget, it is important to clarify in advance which systems to prioritize and who will make decisions regarding measures such as service suspensions, and to respond after establishing clear priorities.

Crisis management goes beyond technical measures alone

Regarding this recent PHP vulnerability, many of you have already received notifications from business partners about the suspension of websites or web applications, or the interruption of services. When responding to vulnerabilities or security incidents, attention tends to focus on technical tasks such as system investigations and applying patches. However, when system outages or service restrictions occur, the impact extends to customers, business partners, and employees.

If the status of the response and the scope of the impact are not adequately communicated, there is a risk of conflicting judgments within the company or of customers and business partners being unable to obtain the necessary information. Furthermore, when information is lacking, speculation and inaccurate information may spread, potentially leading to a loss of trust in the organization and its brand. The purpose of communication during such crises is not to disseminate information, but to ensure stakeholders accurately understand the situation so they can make proper decisions and take appropriate actions, as well as convey a commitment to addressing risks with integrity. To achieve this, it is essential to establish clear guidelines for internal and external communication regarding the methods of Information sharing and the content to be conveyed.

Internal information sharing

It is important to establish a shared understanding of the situation and response strategies that transcends hierarchical boundaries from management to employees, and crosses departmental lines in the organization or team. Insufficient information sharing can lead to delays in response or result in inconsistent explanations depending on the person providing the information. Examples of Information to be shared internally include the following:

Current Situation – Which systems may be affected, what has been confirmed, and what remains unknown or is currently being verified

Status of Investigation and Response – What is being verified, and what measures are being implemented

Division of Roles - Who is handling technical responses, and who is responsible for management decisions and customer support

Rules for Information Sharing – How to respond to inquires and the approval procedures for releasing information externally

In particular, it is crucial to share necessary information at the appropriate time to prevent employees handling customer or business partner inquiries from responding without full knowledge of the situation, and to exercise judgment by labeling unconfirmed details as under investigation rather than providing speculative information.

External communication (Crisis public relations)

When you issue information externally, it is important to convey details in a way that allows stakeholders to understand the company’s situation and determine the necessary actions. Failing to disclose information that should be made public, or making definitive statements about matters that have not yet been confirmed, may require corrections later and can sometimes damage credibility. On the other hand, just because a vulnerability has been identified does not necessarily mean the company has suffered damage. Therefore, it is essential to distinguish between confirmed facts and matters still under investigation when communicating. The following are examples of information to be communicated externally:

Current Situation – Which services are affected and what has been confirmed at this time

Impact on Customers and Business Partners – Whether there will be changes or disruptions to service use, orders, reservations, deliveries, etc.

Measures Being Taken – Measures currently being implemented or planned, such as investigating the impact, fixing the system, or restricting access, along with the expected completion dates if available

Action Requested of Recipients – Necessary action on the recipient’s part, such as changing passwords, but only if the need has been confirmed

Future Outlook – Timing of the next update, contact information for inquiries, and alternative options

There is no need to wait to issue notifications until the details are confirmed. Rather than focusing on whether or not to make an announcement, it is essential to communicate confirmed facts while clearly stating that unconfirmed matters are under investigation and that aspects without a conclusion are under consideration. Information should be updated as the situation progresses, such as the status of corrective actions, and tailored to the recipient’s perspective. Moreover, information dissemination and information gathering go hand in hand. Rather than disseminating information, reports from the field, for example, by establishing a dedicated contact point as needed, to gain a clearer understanding of what is happening within the organization.

Preparations to make in normal times

So far, we have looked at how to respond after a cyber incident occurs or when vulnerabilities are discovered in the system your company uses. However, cybersecurity is not just about responding. Daily preparedness is essential. Below. I’ll introduce some small steps that SMEs and sole proprietors can implement even with limited budgets and time:

(1)Make a list of system service providers and emergency contacts

Compile a list of companies responsible for the maintenance and management of your website and business systems, as well as your server and cloud service providers and their contact information. Having this information readily available so you can immediately determine who to contact in the problem will lead to a quick response.

(2)Establish procedures for emergency communication and decision-making

Clarify who should report issues or information about vulnerabilities, who will determine the response strategy, and who will handle each specific task. Even with a small staff, simply establishing initial response steps such as “He will contact the maintenance provider” or “We’ll notify customers once we’ve gathered this much information” can make a significant difference in how easily you can handle the incident.

(3)Prepare template for communications with customers and business partners

Prepare templates for emergency announcements externally in the service outages or disruptions to business operations. Designing these templates to clearly distinguish between confirmed facts and matters where the impact has not yet been verified makes it easier to provide the most accurate information possible, even in situations marked by high uncertainty or urgency. In recent years, generative AI has made it possible to quickly draft such messages. However, using it during an emergency can lead to the dissemination of incorrect information, since the time required to verify accuracy is skipped, or the AI platform may be unavailable due to system failures. Therefore, it is necessary to prepare these templates during normal times, before an incident occurs.

I have outlined three small preparatory measures as risk management so far, and some of these may already be in place within your organization. While these initiatives may seem minor, they are all essential components of risk management that protect a company’s or brand’s business operations and reputation.

Accurately gathering and sharing information even in high-pressure situations

When cybersecurity issues or serious concerns arise, it is not easy to handle everything perfectly with limited personnel and budgets. This is especially true for SMEs and sole proprietors, who may have to respond while continuing their daily operations or, at times, may even have to scale back or suspend their operations. That is precisely why it is one of a opportunity to start by gaining a clear understanding of your organization’s systems and management structure during normal times, and by organizing emergency contact information and response procedures. In addition to establishing comprehensive systems, visualizing the intuitive responses, such as who to consult, what to verify, and who to inform, can also help ensure a smooth response.

In high-pressure situations, information may be scarce, or speculation may spread based on fragmentary details. It is at such times that a proactive approach is required one that clearly distinguishes between confirmed facts and unknowns, while sharing information concisely and accurately to guide the response. Risk management involves not only responding when a problem arises but also establishing a state of readiness in normal times that allows you to assess the situation, make judgments, and take action even with limited information. Such preparation ultimately enables effective responses to unexpected emergencies.