_edited.png)
GROWZA | CYBERSECURITY ADVISORY
23 October 2026
Nonprofits, a quick heads-up about your website security.
Recent cybersecurity warnings involving PHP, a technology used by millions of websites, are worth paying attention to.
You can check the official PHP security announcements here:
What is PHP? Simply put, it's a technology that helps websites work behind the scenes. It can handle things like online forms, information stored in databases and website logins. Many websites, including those built using WordPress, rely on it.
Why should nonprofits care?
Our websites do more than tell people who we are. They collect donations, receive applications, hold personal information and connect us to the people who support and depend on our work.
If your website is compromised:
Donation links could be redirected. Supporters might unknowingly send money to fraudsters instead of your organisation.
Beneficiary information could be exposed. Names, ID numbers, contact details and application records could fall into the wrong hands.
Donor information could be stolen. Personal details and giving histories could be accessed without permission.
Your website could be altered or taken offline. This could disrupt your work or mislead people visiting your site.
These are potential consequences of a website compromise, not evidence that your organisation has been affected.
And there's a bigger consideration here.
The nonprofit sector operates on trust and social capital. Much of what we achieve depends on relationships, credibility and the confidence that communities, donors and partners place in us. These take years to build and can be damaged remarkably quickly.
A cybersecurity incident isn't just a technical inconvenience. It can undermine the very relationships that make our work possible.
What should you do?
Nothing complicated. Just contact your website developer or hosting provider and ask them to check whether your website is affected.
Copy and send this message:
"Hi, I've seen the recent cybersecurity warnings about PHP vulnerabilities.
Could you please check whether our website is affected, confirm that the necessary security updates have been applied, and let us know if there's anything else we need to do?
Here's the official PHP website for reference: https://www.php.net/archive/2026.php
Thanks!"
You don't need to become a cybersecurity expert. You just need to make sure someone who understands your website is paying attention.
Not every website uses PHP, and not every PHP website is vulnerable.
But when so much of our work depends on the confidence people place in us, it's worth taking five minutes to make sure our digital systems are secure.
GrowZA | Social Investment Agency
Comments