SalaroFree site check
Writing · Advisory

The October 2026 PHP vulnerabilities: what they mean for small business websites

Two serious flaws in PHP were fixed this week. Here's what happened, what to check today, and what to think about next.

· Salaro

What happened

On 21 October 2026 the PHP project released urgent updates for two flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell”. PHP is the software that runs WordPress, Drupal, Joomla and a large share of all other websites.

Both flaws are rated 9.2 out of 10 for severity. In the worst case, someone on the internet could run their own code on your web server without needing a password. Details leaked before the fixes were ready, and security companies have since reported large numbers of attempts to exploit them. The US Cybersecurity and Infrastructure Security Agency (CISA) has told organisations to patch immediately.

Here in the UK, the government took a number of online services offline as a precaution. BBC News reported that 32 were unavailable and four partially unavailable, and that the National Cyber Security Centre described the situation as unprecedented. The NCSC also said there were no signs of successful breaches. The disruption reached small firms too: one garage in Chepstow couldn't process MOT paperwork online for days because a system it relied on was down.

Who is affected

Every version of PHP from 5.4 up to 8.5.11 is affected, if it's serving web pages. That includes almost every WordPress, Drupal and Joomla website, and most custom PHP sites.

One point is easy to miss. Keeping WordPress, your plugins and your theme up to date does not protect you from this. The flaw is in PHP, the layer underneath all of them. Only updating PHP on the server fixes it.

What to do today

If you have a PHP website, send your host, agency or developer one short message:

“Has the PHP on our server been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later)? If not, when will it be?”

Many managed hosts moved quickly and may already have done this. It's still worth asking, because you shouldn't assume.

If your site runs PHP 8.1 or older, ask a second question: what has been done about it? The PHP project only releases updates for 8.2 and newer. Older versions depend on your host or Linux vendor providing a fix, and CISA advises taking unpatched older systems offline until they are fixed. If nobody can answer, treat that as a warning sign.

If you don't know who looks after your server, that's worth finding out this week. You can see the official details in the php.net security advisory, and there's a useful technical FAQ from watchTowr, one of the security firms tracking it.

Why this keeps happening

Most small business websites are brochure sites: a few pages about the business, some photos, a contact form and perhaps a blog. They change a few times a year. But because they're built on WordPress or similar, each one runs live server software — PHP, a database, plugins — that has to be patched indefinitely.

Often nobody is really responsible for that. The site was built years ago by an agency or a freelancer, the hosting is renewed automatically, and the server software ages quietly in the background. This week showed how much of the web runs like that: Wiz, one of the firms that found the flaws, estimates PHP powers around 70% of websites.

The longer-term option: don't run PHP at all

For a site that is mostly fixed content, there's another approach. It can be rebuilt as a modern static or Next.js site and hosted on a platform like Vercel. The pages are prepared in advance and served from a global network, so there's no PHP interpreter on a server for anyone to attack and no plugin updates to keep up with. Most sites also get faster and cheaper to host.

That doesn't make a site unhackable — nothing does. But it removes the specific kind of risk this week was about. And it isn't right for everyone. A large WooCommerce shop, a membership site or an online course platform depends on server-side features, and is usually better off staying where it is and being patched and maintained properly.

If you're not sure which group you're in, we'll look at your site for free and give you a straight answer.

Move from PHP

We move brochure-style PHP sites to Vercel, keeping your URLs, search rankings, forms and email intact.

See how it works →

Sources