If your business has a website — and most do — there's a good chance it runs on PHP. And this week, PHP had a serious security problem that every business owner should know about.
On October 21st, the PHP development team issued an emergency security advisory for two critical vulnerabilities that allow unauthenticated remote code execution. In plain English: an attacker can potentially take control of a web server running outdated PHP before any login or security check happens. No password needed. The PHP team called it their highest severity rating and asked all users to update immediately.
Am I Affected?
If your website runs on any of these platforms, it almost certainly runs PHP underneath:
- WordPress — used by roughly half of all websites worldwide
- Joomla or Drupal
- WooCommerce or other PHP-based e-commerce platforms
- Many custom business websites built over the past 10–15 years
If you're not sure what your site runs on, your web hosting company can tell you — just ask. Most reputable hosts have already begun patching this automatically, but it's worth confirming.
What Should You Do?
- Contact your web host. Ask them: "Has our PHP been updated to version 8.2.35, 8.3.36, 8.4.27, or 8.5.12?" These are the versions that include the fix. Reputable hosts are actively patching, but a quick confirmation gives you peace of mind.
- If you manage your own server, update PHP immediately through your control panel or system package manager. Don't wait.
- If you use WordPress, also make sure WordPress itself and all your plugins are up to date. Keeping the full stack current is the best ongoing protection — not just a one-time fix.
There's More — Two Additional Advisories This Week
The PHP team has been busy. Two days after the initial emergency patch, they published a follow-up advisory about a second, separate vulnerability in PHP's session upload progress feature. While this one is harder to exploit in practice, the team's recommendation is to disable the feature until the next bugfix release.
And as of today (October 26th), PHP released updated Windows builds to address a third issue — a vulnerability in the Brotli compression library used by PHP's cURL extension. If your site's hosting is Windows-based, that update applies to you as well.
Three security advisories in five days is unusual and tells you the PHP team is taking this seriously. That's good. It also means the vulnerability window is real and active right now.
A Note on WordPress Specifically
WordPress itself is not the problem here — PHP, the underlying language it runs on, is. Think of it like your car being fine but the road having a pothole. WordPress is used by nearly half the internet because it works well. But that also means when the language it runs on has a critical vulnerability, the target surface is enormous. Attackers know this and move fast.
This is a good reminder that keeping a website secure isn't a one-time setup — it's an ongoing responsibility, and the hosting layer is just as important as the software layer.
The Bottom Line
Most businesses won't be directly affected, especially those on managed hosting that patches automatically. But "probably fine" isn't the same as "confirmed fine." A quick call to your web host to verify your PHP version is updated takes five minutes and closes the question entirely.
Sources: PHP Security Advisory — Oct 21, 2026 · PHP Informational Advisory — Oct 23, 2026 · PHP Windows Builds Update — Oct 26, 2026