Global PHP Security Issue: What Has Happened and What Should Your Business Do?

A serious security issue has been discovered in PHP, a technology used to power millions of websites around the world, including those built using WordPress.

Emergency fixes were released on 21 October 2026. Because details of the weaknesses became public before the fixes were ready, and attackers have already been seen trying to exploit them, some organisations have temporarily taken websites offline while they apply the updates.

For UK businesses, the priority is to find out whether your website or other online systems use PHP and, if so, get confirmation from whoever manages them that the necessary security updates have been applied.

Websites running older versions of PHP may need additional work, as they may not receive the standard fixes.

The good news is that fixes are available. The issue is also a timely reminder of why patch management matters: technology only stays secure if someone is responsible for keeping it up to date.

On 21 October 2026, the PHP development team released emergency security updates to address two critical vulnerabilities, widely referred to as “PHP2Shell”.

PHP is a programming language that works behind the scenes on a huge number of websites. You wouldn’t normally see it or need to interact with it, but it helps websites function.

For example, PHP might be responsible for:

• Processing a contact form on your company website.
• Allowing you to log in and update website content.
• Handling online bookings or customer enquiries.
• Supporting an online shop or customer portal.

The two weaknesses could allow cybercriminals to take control of the server a website runs on.

They’re considered particularly serious for three reasons:

• Attackers don’t need a username or password to exploit them.
• Details became public before the fixes were released, giving criminals an opportunity to prepare attacks.
• Security researchers have demonstrated that the weaknesses can be exploited, and attackers have already been seen trying to use them.

The UK’s National Cyber Security Centre (NCSC) has issued an alert urging organisations to update affected systems immediately and, where adequate protection isn’t possible, consider taking them offline.

You may have seen reports of websites becoming unavailable, including government and public sector services across Europe.

Some organisations have deliberately taken affected websites offline as a precaution while security updates are applied.

Think of it like discovering that a type of lock used in buildings around the world has a serious weakness, and that instructions for picking it are already circulating.

Even if nobody has entered your building, you’d want to replace the lock as quickly as possible. If you couldn’t do that straight away, you might temporarily close the building rather than leave it exposed.

That’s essentially the decision some organisations have faced.

A website being taken offline does not necessarily mean it has been hacked. It may simply mean its owners are taking sensible precautions.

Potentially, yes.

PHP is used by many popular website platforms, including WordPress, Drupal, Joomla and Magento.

Using one of these platforms doesn’t mean your website has been compromised. However, it does mean the underlying PHP software needs to be checked to establish whether the relevant security updates have been applied.

PHP is also used by other online services and business applications, sometimes without it being obvious. The NCSC specifically advises organisations to check third-party products and services that may include PHP.

If your website is built using a fully hosted website builder, where you don’t manage the hosting yourself, the platform provider will generally be responsible for updating the underlying technology. Check its service updates if you’re unsure.

In everyday terms, someone could potentially gain unauthorised access to the technology running your website.

Depending on how that system is configured, the consequences could include:

1. Customer information being exposed

If your website stores customer details, enquiry submissions or other sensitive information, attackers might be able to access that data, potentially creating data protection concerns.

2. Your website being altered

Criminals could change website content, insert malicious links or redirect visitors to fraudulent pages.

3. Business disruption

An attack could interrupt online enquiries, bookings, sales or other services your business relies on.

4. Wider security problems

If the affected server is connected to other business systems, attackers might use that access to reach additional information or services.

These are potential consequences rather than evidence that every affected website has been attacked. However, with attackers already trying to exploit the vulnerabilities, businesses should treat the issue as a priority.

You don’t need to become a PHP expert or make technical changes yourself, but there are some straightforward steps worth taking.

1. Contact whoever manages your website

If you use an external website developer, hosting provider or digital agency, get in touch with them.

These are the questions worth asking:

• Does our website, or any other system we use, run on PHP?
• Have the PHP security updates released on 21 October 2026 been applied?
• Which version of PHP are we running, and is it still supported?
• Have you checked for any signs of unauthorised access before the update?
• When was our last website backup, and has it been tested?

A competent website or hosting provider should be able to answer these questions or investigate on your behalf.

2. Make sure the security updates have been applied

The PHP development team has released fixes in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Your hosting provider or technical team should confirm that your website is protected. Some providers may apply security fixes without changing the version number, so ask for confirmation rather than relying on the number alone.

This is separate from the updates you might normally install through the WordPress dashboard.

Older versions of PHP need particular attention. PHP 8.1 and earlier are no longer supported by the PHP project. Limited emergency fixes or hosting-provider patches may be available, but these should not be treated as a long-term solution.

If your website runs on an older version, arrange an upgrade with your developer as soon as possible. This may require some changes to the website itself.

Finally, ask your provider to check for signs of compromise. Applying an update addresses the vulnerability, but it won’t automatically undo any damage if someone gained access beforehand.

3. Check any other online business systems

Your website might not be the only place your business uses PHP.

Customer portals, booking systems and specialist business applications may also rely on it.

If these are provided by third-party suppliers, ask whether they are affected and what action has been taken.

4. Make sure you have a reliable website backup

A current, recoverable backup won’t prevent an attack, but it can make recovery much easier if something goes wrong.

Make sure your backup includes the website’s database and content, not just a copy of the visible pages.

It’s also worth checking that backups are tested periodically, rather than assuming they’re working.

5. Don’t ignore warnings from your hosting provider

Some hosting companies may temporarily restrict services or schedule emergency maintenance while applying updates.

This can be inconvenient, particularly if your website generates enquiries or sales, but protecting the system should take priority.

If your provider says action is required, don’t postpone it until your next routine maintenance window.

If an affected system cannot be updated or adequately protected, your technical provider may recommend temporarily taking it offline.

That’s encouraging, but it doesn’t necessarily mean everything is secure.

A vulnerable website can continue operating normally without displaying any obvious signs of a problem. Even a website that has been accessed by criminals may look exactly the same as it did before.

Equally, your hosting provider may already have installed the updates without any noticeable disruption.

The important thing is to establish that someone has checked.

A company website isn’t just a digital brochure.

Like your laptops, servers and business software, it relies on technology that needs regular security updates.

New vulnerabilities are discovered all the time. Most don’t make headlines, but they can still pose significant risks if they’re left unaddressed.

This is what patch management is about: knowing what technology your business relies on, applying security updates promptly and making sure someone is clearly responsible for doing it.

Website maintenance can easily fall between suppliers.

Your IT provider might manage your office technology, a marketing agency looks after the website and another company provides the hosting.

There’s nothing wrong with that arrangement, provided everyone knows who’s responsible for keeping each part secure and up to date.

It’s an important distinction. Having IT support in place doesn’t automatically mean your website or every cloud-based service you use is covered by the same maintenance arrangements.

The global PHP security issue is significant, and the warnings from the NCSC and other cybersecurity authorities should be taken seriously.

However, the situation is manageable when the right steps are taken promptly.

Security fixes are available, and businesses should work with their providers to make sure affected systems are updated and checked for suspicious activity.

The most important message is simple:

Don’t assume your website is secure just because it’s working. Make sure someone has checked and confirmed that the necessary updates have been applied.

At Get Support IT Services, we help businesses across Oxfordshire and the surrounding counties keep their technology secure and up to date.

While website hosting and development are usually handled by specialist web providers, we can help you understand the risks, ask the right questions of your suppliers and make sure your wider IT environment is properly maintained.

We provide managed IT support, patch management and cybersecurity advice to help businesses identify vulnerabilities and reduce their exposure to cyber threats.

If you’re unsure who’s responsible for keeping your systems secure and up to date, get in touch with Get Support. We’ll help you understand where things stand and what action may be needed.

---

1. Has my business website been hacked because of the PHP issue?

Not necessarily. A security vulnerability means attackers may have an opportunity to exploit a system, not that every affected website has been attacked. Your website provider can establish whether your system was vulnerable and investigate signs of suspicious activity.

2. Does the PHP problem affect WordPress websites?

Yes, potentially. WordPress runs on PHP, so the underlying server software needs to be checked and updated where necessary. Installing the latest WordPress updates, plugins or themes isn’t a substitute for updating PHP itself.

3. Can I fix the problem myself?

Unless you’re experienced in website hosting and server management, we’d recommend speaking to your hosting provider or website developer. PHP updates can affect how a website works, so they should be applied carefully and tested.

4. Should I take my website offline?

Not automatically. If the appropriate security fixes have been applied, taking the website offline is unlikely to be necessary. However, the NCSC recommends considering this if an affected system cannot be updated or adequately protected. Your hosting provider or developer should assess the risks and advise you.

5. Can Get Support help if I’m unsure whether my website is affected?

We can help you understand the risks, identify which suppliers are responsible for different systems and establish the right questions to ask them. We also provide managed patch management and cybersecurity reviews for your wider business IT, helping ensure vulnerabilities are identified and addressed promptly.