Critical PHP Flaws Put Business Websites at Risk—Check Yours Now

ByMike Moffit

On October 21, 2026, the PHP project released emergency updates for two critical security flaws. You may never have heard of PHP, but your website probably runs on it. PHP is the programming language behind WordPress, Drupal, Joomla, Magento, and a big chunk of the rest of the Web. It runs on the server, building each page before a visitor sees it.

These flaws let an attacker run their own code on a vulnerable server without logging in first. The PHP project rates both of them 9.2 out of 10 on the industry’s standard severity scale. In plain terms, someone on the other side of the world could take over your website and anything else running on that server. The National Security Agency warned that flaws like these often give attackers a direct route to a server’s files and database, which is where customer information lives.

Updating WordPress Won’t Cover This One

Most website security problems live in a plug-in or a theme, which is why keeping WordPress updated matters so much. Researchers have nicknamed these flaws “PHP2Shell,” and they’re in PHP itself. A WordPress site with every update installed is still vulnerable if the underlying server runs an unpatched version of PHP. Fixing that is the job of whoever runs the server: usually your hosting provider, sometimes your Web developer.

The rollout was also messier than usual. Details leaked before the fix was ready, researchers have demonstrated a working attack, and Cloudflare’s chief technology officer said the company was seeing early attacks. Nobody had publicly confirmed a successful break-in by release day, but some organizations weren’t waiting to find out. BambooHR took its service offline as a precaution, and the Netherlands pulled DigiD, its government login system, along with other government sites.

Your Macs and iPhones Should Be Fine

Apple stopped including PHP with macOS 12 Monterey, and iOS never had it; there’s nothing to worry about on updated devices. However, older Apple devices could be at risk; please reach out if you have concerns. If you or a developer installed PHP on a Mac for testing (through Homebrew, for instance), be sure to update that copy too.

The Version Number Doesn’t Tell the Whole Story

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. You’d think checking your site would just mean comparing numbers. Unfortunately, it doesn’t.

Many hosting companies run PHP packages from Linux distributions such as Ubuntu and Red Hat. Those vendors received the fixes ahead of time and often ship them under the old version number. A site that reports PHP 8.1 might be patched, and one that reports 8.3 might not be. Old versions are everywhere, too. Looking at Internet scan data from the day before the release, the security firm Mallory found that 59% of servers reported a PHP version of 8.1 or older, all versions the PHP project no longer supports.

So check the number, then keep going:

  • Look up your PHP version: In WordPress, go to Tools > Site Health, click Info, and expand the Server section. Hosting control panels such as cPanel and Plesk show it too.
  • Ask your host a specific question: Skip “What version are we on?” and ask, “Is the October 21 PHP security fix installed on our server, and has PHP been restarted since?” A good host can answer that quickly. If yours can’t, that’s worth knowing as well.
  • Plan an upgrade from old versions: The PHP project no longer supports PHP 8.1 and earlier, and 8.2 joins that list on December 31, 2026. If your site runs any of those, schedule a move to PHP 8.3 or later. Back up the site first and test before switching the live site—older themes and plug-ins sometimes break on newer PHP, which is exactly why so many sites never got upgraded.
  • Lean on Cloudflare for now: If your site’s traffic runs through Cloudflare, even on its free plan, Cloudflare has added rules that block known attack methods. That buys time. It doesn’t replace the fix.
  • Watch for signs of trouble: Unfamiliar administrator accounts, files nobody added, pages that redirect to strange sites, and browser or Google warnings about your site all deserve a closer look from whoever manages it.

If You Run a Business

A website is running software and someone needs to own its upkeep. If you can’t name that person right now, start there.

Think beyond the website, too. PHP also turns up in hosting control panels and in the Web-based admin pages of some office equipment, so ask your IT provider whether anything else you rely on runs it. The NSA and the FBI’s Cyber Division both told organizations that if they can’t update right away, they should take the system offline until it’s fixed, and the UK’s National Cyber Security Centre said the same. That sounds drastic, but a website down for a day costs far less than one that’s been taken over.

The Bottom Line

Check your site today, and get a straight answer from your host about whether the fix is installed. If your site is stuck on an old version of PHP, let this be the push to finally upgrade it. If you’d like us to check your website or handle the upgrade, get in touch.

(Featured image credit: ChatGPT)

Social Media: Think keeping WordPress updated keeps your website safe? Not this time. A critical flaw in PHP, the software underneath most business websites, got an emergency fix on October 21—here’s how to make sure your site has it.

Similar Posts

  • My visiting family went out dolphin watching today taking advantage of the sunny day. The dogs and I are hanging out at my home office and I am listening to some Eagles music as I work.

    Thank you for reading this issue of Kibbles & Bytes!

    _Don, Dean, Emily & Scott_

  • The Little Guy(s)

    You know I am a rabid Boston Celtics fan, and I have been since I was a child listening to games on my transistor radio, searching for the gravely voice of Johnny Most. These days our All-Star and team leader is Isiah Thomas who NBA hall of famer, Tommy Heinsohn, always refers to as the “little guy”. We have been thinking of changing our dog, Max’s name to the little guy as a result.

    It was little iPhone and little iPad Pro day at the Apple event. Apple introduced the 4-inch iPhone SE and the iPad Pro 9.7-inch tablet. In other hardware announcements, there were new watch bands for the Apple Watch and a new Lightning to USB 3 camera adapter. The original iPad Air is now discontinued and the iPad Air 2 with a more limited selection becomes the entry-level 9.7-inch iPad.

    I have gotten used to the size of my iPhone 6 but there are many people that want a smaller iPhone. Having a big iPhone 6 or 6+ sticking out of your back pocket is an invitation to theft and they do get a big bulky in the front pocket of your jeans. The iPhone SE uses the iPhone 5 form factor, with a 4-inch screen and aluminum case. The iPhone SE is not crimping on power though, as it meets almost all of the specifications of the iPhone 6s. It fails to match up to the current iPhone lineup only in the lack of the 3D Touch technology, the Taptic Engine that provides feedback you can feel, and slower wireless networking. It’s either $399 or $499, with 16 GB or 64 GB of storage, and comes in the same four colors, Silver, Space Gray, Gold and Rose Gold. We have found that most cases for the iPhone 5 should work with the iPhone SE. These are shipping on March 31.

    p{text-align: center;}. !http://blog.smalldog.com/images/4692.png!

    The 12.9-inch iPad Pro, introduced last year with the Apple Pencil and Smart Keyboard, has enjoyed some moderate acceptance as a productivity device. I can see how for some, it might be their only device. And for artists, architects and others the iPad Pro is a digital drawing board like no other. But it is 12.9 inches and that is just a bit large for some. Apple introduced the 9.7-inch iPad Pro to meet this need, which meets or exceeds many of the larger model’s specs.

    For instance, the smaller model’s screen can display more colors and adjusts its white balance to match the ambient light in the room. Its cameras are notably better — the rear camera is 12 megapixels instead of 8 and has a True Tone flash, while the front camera is 5 megapixels instead of 1.2 and can use the screen as a flash. Plus, the new iPad Pro can record 4K video instead of just 1080p. I assume we will see these upgrades to the 12.9 inch iPad Pro in the future but the smaller version is a powerhouse.

    The 9.7-inch iPad Pro’s A9X chip is somewhat slower, it has half the RAM, and its Lightning port transfers data at only USB 2 speeds. But if the size is right for you, prices start at $599 for 32 GB of storage and go up to $899 for 256 GB. It will be shipping on March 31 in four colors: silver, gold, space gray, and rose gold. Cases and accessories designed to fit the iPad Air 2 should work with the 9.7-inch iPad Pro. We have our orders in with Apple and should have stock by the launch date. I think this new iPad Pro is going to be the iPad of choice for a lot of people.

    p{text-align: center;}. !http://blog.smalldog.com/images/4689.png!

    Apple also introduced the $39 Lightning to USB3 camera adapter. It is much more than a camera adapter though and opens the Lightning port to a lot of USB devices. With the Lightning to USB 3 Camera Adapter, it’s easy to transfer photos and videos from your high-resolution digital camera to your iPad Pro.
    If you connect with a USB Power Adapter, you can connect USB peripherals like hubs, ethernet adapters, audio/MIDI interfaces, and card readers for CompactFlash, SD, microSD, and more. This is a new and important step by Apple in making the Lightning port much more versatile.