A Serious Security Flaw Has Been Found in PHP: What It Means for Your Website
Posted by: Larry Ances
On 21st October 2026, the team behind PHP released emergency security updates. PHP is the software that runs behind a huge number of websites, including WordPress, Drupal and Joomla, as well as many custom-built business systems. Even if you have never heard of it, there is a good chance your website uses it.
What happened
Two serious flaws were found in PHP itself. In plain terms, they could let someone take control of a web server without needing a password, simply by sending it specially crafted requests. They have been given the highest-level warnings, and security researchers have shown the attack working against up-to-date, well-maintained websites.
That last point matters. This isn't a problem with one plugin or one badly built site. It sits in the software underneath, so keeping your website itself up to date does not fix it.
Attackers moved quickly, with attempts reported even before the announcement and rising sharply in the days after. We have not seen evidence of widespread successful attacks, but it is sensible to treat this as urgent rather than wait and see.
A second, much smaller issue was announced on 23rd October. It only affects a narrow set of setups, PHP considers it unlikely to be a problem in practice, and a routine fix is on the way.
What needs to happen
The real fix is for whoever looks after your hosting to update PHP on the server. Fixed versions were released for the current supported releases of PHP (8.2 to 8.5).
If your website runs on an older version, such as PHP 8.1 or earlier, it no longer gets regular updates from PHP at all. That site needs a planned upgrade, or confirmation from your hosting provider that they have applied the fix themselves.
There are temporary measures that can lower the risk while the update is arranged, but they are a stopgap, not a solution.
Questions to ask your hosting company or developer
- Which version of PHP is my website running?
- Has it been updated since 21st October?
- If it is an older version, what is the plan to move to a supported one?
- Has anyone checked the server for unusual activity since the announcement?
Be wary of "quick fix" plugins or tips found online. They aren't a substitute for the proper update.
Warning signs
Sudden bursts of error pages, a website that keeps crashing or restarting for no clear reason, or strange activity in your hosting logs can all be signs that someone is probing the server. If you notice any of these, speak to whoever manages your hosting straight away and avoid trying to fix it yourself.
How J&L Digital can help
If you have a maintenance package with us, keeping your server software up to date is part of that service, so you can relax. If you don't have one, that's perfectly normal, but it does mean we may not have updated your website's PHP for you. Drop us a line and we'll check which version your site is running, and the next steps to secure your site.
J&L Digital, based in Redhill, Surrey, specialises in comprehensive technology solutions including website design, software development, IT services, and digital marketing. Contact us to talk through how we can help keep your website secure.
Sources: The PHP Foundation: Today's PHP security release, Patchstack: Major security alert, PHP vulnerable to critical RCE, The Hacker News: PHP warns of another unpatched RCE risk
About: Larry Ances
Larry is a seasoned computer programmer with a rich history of developing efficient and high-quality projects. He graduated from Negros Oriental State University with a degree in Computer Science. His drive to continually take on challenging experiences in his field is something we greatly admire and we believe this quality makes him an asset to our team.
