PHP is the software that quietly runs a large share of business websites, including most WordPress sites and many online shops, booking systems and customer portals. On 21 October 2026 the PHP project released emergency updates for two critical security flaws, and anyone running a PHP website needs to make sure the update has been applied.
What Has Happened
The two flaws are known as CVE-2026-109618 and CVE-2026-109619. In plain terms, both could allow an attacker to run their own commands on your web server without logging in. PHP rates each as 9.2 out of 10 for severity.
Details of the flaws leaked ahead of the planned announcement, so the fixes were released on schedule rather than delayed. Cloudflare has said it is already seeing early attack attempts, although another security firm, watchTowr, said it had not seen attacks in the wild at the time of the announcement. Either way, once a fix is published, attackers can study it, so the safe assumption is that the window to patch is short.
PHP has not officially stated which older versions are affected. watchTowr believes the problem reaches back a long way, so do not assume an old version is safe just because it is not mentioned.
Why It Matters for a Small Business
- Your website may be the way in. A compromised web server can be used to steal customer data, host scams or malware under your name, or as a stepping stone into your wider systems.
- Nobody may be looking after it. Many small business sites were built by an agency years ago and are hosted somewhere no one checks. Those are the sites most likely to be missed.
- Updates do not always happen by themselves. Automatic updates on some hosting setups do not cover PHP, so "it updates automatically" is worth confirming rather than assuming.
What to Do This Week
1. Find Out What Your Website Runs On
Ask whoever hosts or built your site which version of PHP it uses and where it is hosted. If you cannot get a clear answer, that is a finding in itself. Also list any other systems that use PHP, such as a customer portal, booking tool or intranet.
2. Get the Fixed Version Installed
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On managed hosting, ask your provider to confirm in writing that they have applied the update. If you run your own server, the update needs installing and the web service restarting.
PHP 8.1 and older are no longer supported by the PHP project, so they will not get an official fix. If your site is on one of these, your options are a supplier that provides its own patched version, or moving to a supported version. This is a good reason to plan the upgrade now rather than wait for the next emergency.
3. Check for Signs of a Problem
Once patched, ask for a quick review of the site for unfamiliar files, new admin users, unexpected changes and unusual traffic from the last few days. Make sure you have a recent, tested backup of the site, held somewhere an attacker on the web server could not reach.
PHP has published temporary settings that reduce exposure if you cannot patch immediately, but it is clear that they do not make a server safe. Updating is the only complete fix.
Key Dates
| Date | What happens |
|---|---|
| 20 October 2026 | PHP warns that emergency fixes are coming; details leak |
| 21 October 2026 | Fixed versions released: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 |
| This week | Confirm your website and hosting are patched |
Need a Hand?
If you are not sure what your website runs on, who looks after it, or whether it has been patched, we can help. We can identify the PHP-based systems your business relies on, check they are up to date, arrange the update with your hosting provider or web developer, and keep an eye on them going forward.
Get in touch and we will tell you where you stand and what to do first. There is no obligation and no sales pitch, just a straight conversation about your website's security.