In October 2026 the PHP security team released fixes for two critical flaws in PHP, the programming language WordPress and many other websites are built on. Its advisory said the bugs could allow unauthenticated remote code execution and urged all users to update immediately.
Europe’s cyber agencies, including ENISA and CERT-EU, told organisations to find their PHP systems, deal with anything facing the internet first and consider isolating exposed applications they couldn’t fix straight away. Government websites in Finland and the Netherlands were among those taken offline as a precaution, Reuters reported.
New Zealand’s National Cyber Security Centre (NCSC) issued its own alert, saying it was aware of reports of active exploitation and urging organisations to patch as soon as possible.
Patching in a hurry is the cheap end of a cyber incident. The expensive end is what happened to two of Britain’s best-known companies in 2025.
What an attack costs a big company
Marks & Spencer told the market in May 2025 that a cyber incident would cost it about £300m in operating profit over its 2025/26 year, before insurance, cost savings and other trading actions.
Jaguar Land Rover announced a cyber incident in September 2025 and paused production, restarting in phases from 8 October. Its results for the September quarter carried £196m of costs relating to the incident. In October it also secured a £1.5bn commercial loan guaranteed by UK Export Finance.
The NCSC’s Cyber Threat Report 2026 describes a mid-2025 attack on Qantas in which criminals used AI-enabled voice phishing to talk call centre staff into loading tampered software for a third-party application. Data on about 5.7 million customers was stolen.
In May 2026 a breach of the Canvas learning platform hit more than 30 New Zealand tertiary institutions, schools and education suppliers. The Ministry of Education estimates
110,000 to 120,000 students and staff were affected, and the report says it took the US-based operator several days to restore services.
The New Zealand numbers
The NCSC received 4,673 incident reports in the year to June 2026, down from 5,995 the year before. Victims reported $23.8 million in direct financial losses, down from $26.9 million, and the NCSC notes that not all losses are reported.
The serious end grew. Incidents of potential national significance rose from 331 to 369, driven by an 18% jump in criminal or financially motivated attacks, and four were classed as highly significant. The NCSC says those included criminals using stolen logins to take personal information from health services organisations.
Paying a ransom rarely ends it. A Hiscox survey of 5,750 businesses, cited in the report, found about 40% of victims who paid didn’t get their data back, and about 80% of organisations that paid were attacked again.
NCSC deputy director-general Catriona Robinson writes in the report that too many New Zealand organisations still aren’t getting the basics right, and that frontier AI will help attackers find new flaws faster. “If you think it can’t happen to you, you’re wrong,” she writes.
Where to start
The NCSC’s top ten Critical Controls are its guide to where a business should spend time and money first. The NCSC says that, done properly, they can prevent, detect or contain the majority of cyber attacks.
The list starts with patching software and systems, turning on multi-factor authentication and giving staff a password manager. It also covers centralised logging, security awareness training, tracking devices and software through their life, tested backups, application control, least privilege and network segmentation.
The Qantas case puts suppliers on the list too. The NCSC report asks leaders whether they assess a supplier’s cyber security during procurement, and whether their contracts set clear data protection expectations.
Any business can report an incident to the NCSC through ncsc.govt.nz and get advice on what to do next.
SPONSORED
