The PHP security warning: what business owners should do now

October 22, 2026

If you have seen a warning about PHP and wondered whether your business website is involved, start with one question:

“Does my website use the affected software, and has the fix been applied?”

On October 21, PHP released fixes for two critical security flaws. They need prompt attention, but the warning alone is not evidence that your website has been hacked. PHP security advisory

You do not need programming skills. Find who maintains your website and get a specific answer.

What is PHP, in plain English?

PHP is software that runs on a server, the computer behind a website. It helps build pages and carry out website tasks before the result reaches a visitor’s browser. NSA advisory

Think of the website as the shopfront and PHP as part of the equipment behind the counter. You may never see it, but your site may depend on it.

WordPress uses PHP. So do WooCommerce stores and many custom-built websites. Not every website does. WordPress requirements, WooCommerce server requirements

What makes this warning serious?

The flaws can let an attacker run their own instructions on an affected server without signing in. The technical term is unauthenticated remote code execution. That could lead to stolen information or disrupted services. NSA advisory

The problems are in PHP itself. Updating a WordPress theme or plugin does not necessarily update PHP underneath it. WordPress says no WordPress update is required or planned specifically for these issues. WordPress security notice

A website can look normal while running vulnerable software. Looking at the homepage is not a patch check.

Who should check?

WordPress, WooCommerce or a custom PHP site: Contact your hosting company or maintenance provider now. Your host is the company that runs the server where your site lives.
A fully managed website service: Ask the provider whether this affects your site and what they have done. “Managed” does not tell you which fixes are installed.
A static website or another technology: This particular issue may not apply. Have your provider confirm whether any connected forms, booking tools or other services use affected PHP.
Not sure, or the builder has moved on: Start with the steps below.

In WordPress, Tools → Site Health → Info → Server shows the PHP version. Treat that as a starting point, not proof that the fix is installed. WordPress security notice

Paid someone to build it years ago?

Start with your records, not the website settings. Search bills and email for hosting payments or the welcome message from the company that set up your site. Ask the former builder: “Who hosts my website, and who handles its PHP updates?”

The company that registered your website address may be different from your host. A domain renewal bill alone may not tell you who runs the site. Domains and hosting explained

Contact the host through its official support route and use the message below. Ask whether your plan includes this update. If you manage your own server, its administrator or a qualified developer needs to handle it. If you cannot identify the host or regain access, ask a web professional to help through official recovery processes.

Do not try an unfamiliar PHP-version switch or install a plugin advertised as the fix. Your practical job is to find the responsible person and get the work confirmed.

What counts as a fix?

PHP released these fixed versions on October 21:

PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35

These are different version families, or “branches.” Your provider should apply a compatible patched release, not blindly switch to 8.5. PHP security advisory

A backported fix repairs an older-looking software package. Ubuntu lists such fixes, so the number alone does not establish patch status. Ask for vendor confirmation that the installed package fixes both CVE-2026-109618 and CVE-2026-109619. Those numbers identify the two flaws. Ubuntu security notice

PHP says temporary protective measures may reduce exposure but are not a complete solution. An update is still necessary. PHP security advisory

Check reassuring notices’ dates, too. SiteGround’s October 21, 11:30 UTC notice describes pre-release mitigation rules. That alone does not establish that the final PHP fixes are installed for your site. Ask for current, site-specific confirmation. SiteGround notice

Get it fixed without guessing at settings

Ask your host or qualified developer to confirm a current, recoverable backup and check compatibility before updating. Then have them test the parts customers rely on, such as forms, bookings, logins and checkout. WordPress’s update guidance also recommends backups and compatibility checks. WordPress update preparation

If you cannot update PHP yourself, that is a reason to contact the responsible provider urgently, not to experiment with server settings. Do not let a vague “we will look at it” become the whole plan. Get an owner and a time for confirmation.

For affected systems that cannot be updated immediately, the NSA recommends taking them offline until the vulnerabilities are fully addressed. NSA advisory

Coordinate that urgently with your provider. Do not assume a maintenance-page plugin takes PHP offline. Ask your provider to confirm the vulnerable service is no longer exposed. This is not an instruction to shut down every business website regardless of its technology or patch status.

A message you can send your provider

Please check [website address] for the October 21 PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

Does this site use affected PHP? What exact PHP version and vendor package is serving it, and does it include both fixes?

If patched, please confirm the fixes are active for this site. If not, who is handling the update, and when? Please confirm backup and testing arrangements. If an immediate update is not possible, please explain how you will take the affected service offline safely until fixed.

Use your provider’s known support route. You do not need to send passwords or recovery codes with this request.

Your short checklist

Identify the host or person responsible.
Confirm whether your exact site is affected.
Obtain evidence of both fixes, not just a general reassurance.
Confirm backup and testing arrangements for any update.
Escalate promptly if an affected site cannot be patched.
Keep the provider’s written answer with your website records.

The useful result is a clear answer about your site, a named person responsible, and confirmation that the necessary work is done.