PHP Flaw & National AI Warnings: The Critical Importance of the UK Cyber Skills Gap
Critical PHP flaws took 32 UK government services offline in October 2026, and the NCSC now says AI-powered ransomware attacks on critical infrastructure are highly likely by 2028. Both alerts show that the UK needs more people who can find weaknesses, apply fixes safely and keep essential services running.
Two cybersecurity stories have dominated UK news this autumn. One was an emergency fix for software that runs much of the web; the other, a national warning about AI-powered attacks on hospitals and power stations.
If those headlines have made you anxious or maybe curious about how these cybersecurity issues of national importance are handled, that's understandable. The worrying news: there certainly is a deficit of cyber professionals in the UK. Government research published in September 2026 found that 57% of UK businesses have a basic technical cybersecurity skills gap, up from 49% a year earlier.
The upside is that for people who can imagine a career future in cyber, there is huge demand for qualified professionals, including those who are newly trained or moving from other sectors. As a Tech, IT and Cyber Career Consultant, I speak to people every week who are weighing up a move into cybersecurity, and I tell them all that there could not be a better time.
In this blog, I'll explain what happened with the PHP flaw and what the NCSC's AI warning says. Then I'll show why both stories come back to skills, and the first steps into cybersecurity. If you'd rather talk it through, our Career Consultants offer a free one-to-one consultation.
Written by
With four years at Learning People and a solid foundation in IT and Cybersecurity, Chris guides people through the fast-evolving tech landscape and into their dream jobs. He combines hands-on technical expertise with insider industry insights to help learners make informed career decisions.
What Happened When the PHP Flaw Took 32 UK Government Services Offline?
On 21 October 2026, the PHP project released emergency patches for two critical flaws. The next day, tech minister Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four partially unavailable while security work was carried out PHP is a programming language behind huge parts of the web, including many WordPress, Drupal and Magento sites.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, could let an attacker run their own code on a server without logging in. The NCSC urged organisations to update PHP straight away, or to consider taking websites offline if they couldn't patch immediately.
Attackers moved fast. Cloudflare's chief executive said the company saw hundreds of thousands of attempts to exploit the flaws within two hours of the announcement. Downing Street said no large public-facing critical services were affected, and that taking sites offline did not mean they had been hacked.
The precaution still reached everyday life. Government sites in the Netherlands, Germany, France and Finland also went offline as a precaution. The faster a team can find what it runs, test a fix and bring services back, the smaller that interruption is.
Did You Know? The NCSC Rated 80 Cyber Incidents as Nationally Significant in a Year
The NCSC's Annual Review 2026 covers the year to 31 August 2026, when it received 1,831 incident reports and rated 80 as nationally significant. For a closer look at how a breach affects customers, read our blog on the Revolut data breach.
What Does the NCSC's Warning About AI Malware Actually Say?
The NCSC launched its State of the Cyber Nation report on 3 November 2026. It says AI-powered malware is highly likely to be used in ransomware attacks on UK critical infrastructure such as power stations, airports and hospitals by 2028. It's a forecast of risk over the next two years. It doesn't say any of those sites have been breached.
NCSC chief executive Dr Richard Horne said the threat comes less from new attack techniques than from old weaknesses. In his view, decades of running technology on the cheap have left flaws that AI now makes faster and cheaper to exploit. He has urged organisations to invest in security with urgency.
The PHP flaws show both sides of that. OpenAI said a researcher found one of the flaws using one of its AI models, while security firm Wiz discovered and reported both independently. AI helped defenders uncover a weakness that had sat unnoticed for years, and attackers were trying to use it within hours. The NCSC's frontier AI guidance says AI shortens the time between a flaw being published and being exploited, which leaves less time to patch.
The government has also committed £60 million to the first phase of a national Cyber Shield, which will use AI agents for defence. A further £70 million will fund a new National Exposure and Real-Time Vulnerability (NERV) Centre to spot weaknesses across critical infrastructure.
Why Do These Cybersecurity Alerts Show the UK Cyber Skills Gap Matters?
Both stories come down to people. Detection tools and AI can flag a weakness, but someone has to decide what to fix first, apply the update safely and check that services still work. The UK is short of people with those skills.
The government's Cyber security skills in the UK labour market 2026 report found that 57% of UK businesses had a basic technical skills gap, up from 49% the year before. The same report found core cybersecurity job postings rose 7% compared with 2024, and 70% of cybersecurity businesses now have staff using AI in their day-to-day work [VERIFY: all three figures].
That last figure is useful for career changers. AI is becoming part of the toolkit, and the NCSC's guidance says it should complement the skills of security staff. Someone still needs to understand networks, judge risk and explain to colleagues why a website has to come down for an afternoon.
The skills gap doesn't mean jobs are easy to walk into. A July 2026 industry report described the cyber job market as an hourglass. In 2024, 65% of core cyber job postings sought mid-level experience and 17% were entry level. That's why most career changers start in an IT or bridging role and build up from there.
Do alerts like the PHP flaw make this a good time to move into cybersecurity, and what's a realistic first role?
Alerts like the PHP flaw are a useful reminder that cybersecurity isn't abstract. When a critical flaw lands, organisations need people who can find what's affected, fix it safely and keep services running, and there aren't enough of them. So yes, it's a good time to start, but go in with realistic expectations. Most employers want some hands-on experience, so the most common first step I see is an IT support or service desk role, alongside certifications like CompTIA A+ and Security+. From there, moving into a SOC Analyst role is a realistic next step for many career changers.
What Do Cybersecurity Teams Do When an Alert Like PHP2Shell Lands?
When a critical flaw is announced, a security team's job is to find every affected system, fix it in the right order and check whether attackers got in first. In practice, that usually looks like this:
- Find what you run. Teams check which servers and websites use PHP, and which versions, which is only quick if the organisation keeps an up-to-date list of its systems.
- Decide what comes first. Public-facing and critical services get patched first, and someone decides whether a service is safer offline until it's fixed.
- Test and apply the fix. Where possible, the update is tested before it goes live, downtime is scheduled and colleagues are told what to expect.
- Check for signs of compromise. Analysts review logs for unfamiliar files, new admin accounts or unusual activity, going back to before the flaw was public.
- Restore and record. Services come back online, teams confirm they work and note what would make the next response faster.
That work takes time. Snapshot figures reported on 22 October suggested only around 5% of tracked at-risk UK systems had been patched by mid-afternoon. Self-hosted systems and older, unsupported versions of PHP tend to take longest, because each fix has to be scheduled and tested by someone.
Each step maps to real jobs. This table shows where those tasks sit and where people often start:
| Task during an alert | Typical Role | Common starting certifications |
| Monitoring alerts and suspicious activity | SOC analyst | CompTIA Security+, then CompTIA CySA+ |
| Finding and prioritising weaknesses |
Vulnerability Analyst, Junior Penetration Tester |
CompTIA Security+, then |
| Applying updates and keeping servers running | IT Support Technician, Systems Administrator | CompTIA Security+, then |
| Explaining risk and coordinating the response |
Information Security Analyst |
CompTIA Security+, then |
Can You Start a Career in Cybersecurity Without a Tech Background?
Yes. Most people who move into cybersecurity start with IT and networking foundations, and you don't need to master AI first. If you're starting from scratch, CompTIA A+ covers devices, operating systems and troubleshooting. CompTIA Security+ adds the security basics employers look for.
Experience from another career helps more than people expect. The PHP response needed people who could stay organised under pressure, follow a process and explain a risk in plain English to someone outside IT. Those are skills you may have built in policing, teaching, admin or customer service.
Student story: Jaydeep Gangal
Jaydeep Gangal came to us for advice on certifications and, within a year and a half, gained his CompTIA certifications and landed his first role as a SOC Support Specialist.
If you'd like to test your interest before committing, Learning People Lite offers short online cybersecurity and IT courses you can try at your own pace.
How Learning People Can Help You Start a Career in Cybersecurity
The most useful next step is to pick a target role from the table above and work out the first certification it needs. Our Associate Cyber Security Professional (ACSP) pathway and other career pathway training programs combine recognised certifications with sector-specific AI training.
You won't be studying alone. A StudentCare™ consultant checks in to keep you on track. Our Career Services team helps with your CV, LinkedIn profile, interview preparation and job search. 97% of students who complete our three-phase Career Services program land a job
Book a free career consultation and one of our Career Consultants will help you choose a starting point that fits your experience and goals.
PHP Flaw, AI Malware and Cyber Skills Gap FAQs
Latest Sector Guides and Insights
AIPHP Flaw & National AI Warnings: The Critical Importance of the UK Cyber Skills Gap
Critical PHP flaws took 32 UK government services offline in October 2026, and the NCSC now says AI-powered ransomware attacks on critical infrastructure are highly likely by 2028. Both alerts show that the UK needs more people who can find weaknesses, apply fixes safely and keep essential services running.
Read More
AI37% of UK STEM Workers Say AI Is Arriving Too Fast: AI impact on white-collar jobs
AI is changing UK tech jobs faster than it's cutting them. See how PM, cyber, data, coding and IT roles are shifting, and the AI skills to learn
Read More
DataThe Uses and Impact of AI in Data Analytics
Discover how artificial intelligence is driving and transforming data analytics, from uncovering deeper insights to driving smarter business decisions. Learn about the key uses, benefits, and real-world impact of AI in analytics, and explore how these innovations are shaping the future of data-driven industries.
Read More
CodeVibe Coding Has Grown Up: What Career Changers Need to Know
AI can now turn plain-language ideas into working apps, but speed without scrutiny creates risk. Here’s how vibe coding has matured, what “doomcoding” warns us about, and why coding fundamentals give career changers the edge.
Read More