PHP Security Update: What to Do When a Critical Flaw Hits Your Website (October 2026)

Facts checked against PHP's and the NCSC's own pages at 14:55 UK time on 21 October 2026. We will update this page if their advice changes.

What is the PHP security update, and what should I do?

On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical flaws that can let an attacker run their own code on a web server without logging in. PHP says "All PHP users are strongly encouraged to update immediately" and that updating is the only safe choice (PHP security advisory). The UK's National Cyber Security Centre (NCSC) is encouraging UK organisations to take immediate action (NCSC alert).

PHP is software that runs on a web server and generates a website's pages. WordPress needs it to run, so if your business website runs on WordPress, this is about you. PHP is installed on your hosting company's server, and your host decides which PHP versions your site can use, so the fix comes through them. Your part is to check it has been done, check your PHP version is still supported, and keep your theme and plugins up to date.

Key takeaways

• Ask your host whether your server is on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later.
• PHP 8.1 and older no longer get updates from the PHP project. PHP 8.2 gets security fixes until 31 December 2026.
• Back up, then update WordPress, your theme and your plugins.
• Be wary of "urgent security" emails, even ones that seem to come from your web company.

What to do today

1. Ask your host one question

WordPress.org puts it plainly: "Your hosting company determines which versions of PHP are available for your site" (WordPress.org). So ask them, through their support page or a contact you already have, never a link in an email you were sent:

Has the server my website runs on been updated to one of the PHP versions released on 21 October 2026 (8.5.12, 8.4.27, 8.3.36 or 8.2.35)? Which PHP version is my site using now?

PHP says the companies that package server software (Linux distributions and long-term support vendors) received the patches in advance, so your host may have the update already. If nobody knows who hosts your site, finding out is the first job.

2. Check your WordPress PHP version

In your WordPress dashboard, go to Tools, then Site Health, then the Info tab. Open the Server section and look for PHP version (WordPress.org). Then compare it with PHP's own dates (PHP supported versions and PHP end of life dates):

3. Update PHP in WordPress safely

If you need a newer PHP version, WordPress.org's advice is to prepare first (WordPress.org):

1. Make a backup of your website.
2. Update WordPress, your theme and your plugins, then check the site still works.
3. Install the PHP Compatibility Checker plugin to look for problems. WordPress.org says it "isn't perfect", so treat it as a guide.
4. Change the PHP version in your hosting settings, or ask your host to do it.

While you are there, delete plugins and themes you no longer use. Patchstack, a WordPress security vendor, found 91% of the new WordPress security flaws it counted in 2025 were in plugins (Patchstack). Our Website Security Checklist for Small Businesses covers the rest of the routine.

4. If your site is on PHP 8.1 or older

PHP 8.1 and older have reached end of life and "no longer receive updates from the PHP project". PHP says some distributions and long-term support vendors provide "backported fixes" (the fix adapted for an older version), so ask your host. The lasting answer is a supported version.

Some themes and plugins may not work on a newer PHP version, which is why WordPress.org says to test first. If yours cannot move without breaking, the site needs a developer or a replacement. Our guide WordPress Maintenance vs Rebuild: What a Care Plan Never Fixes helps you weigh up which.

What the PHP security update fixes, in plain English

Because PHP does its work on the server, behind the pages people see, a flaw in PHP sits underneath every site built on it, however well the site itself is looked after.

The two flaws have the official reference numbers CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 on CVSS v4.0, the standard severity score (PHP's advance notice). PHP describes them as remote code execution without a login: a request to the website can lead to the server running an attacker's code. PHP says all PHP installations serving web requests are at risk. It rates the risk highest for one server set-up (Apache with mod_php), where it has shown a working attack. The NCSC says organisations using PHP version 5 onwards are affected.

You may also see the name "php2shell". The Dutch National Cyber Security Centre (NCSC-NL) uses it for its public page on these flaws, which the UK NCSC links to (NCSC-NL). On 21 October NCSC-NL said it had no indication of active exploitation, but considered large-scale exploitation likely in the short term. So follow the steps above today rather than next week.

Is my website safe?

If your site runs on PHP and your host has installed the fixed version, the flaw is fixed for your site. If not, the site is at risk until it is. These figures show how many sites that covers:

• Sites running PHP. W3Techs finds PHP on 69.3% of websites whose server-side language it knows (W3Techs).
• WordPress sites. W3Techs puts WordPress on 39.6% of all websites (W3Techs), and WordPress needs PHP to run.
• Sites on old PHP. By WordPress.org's own count, 36.4% of WordPress sites are on PHP 8.1 or older, and another 23.8% are on PHP 8.2 (WordPress.org statistics; the 36.4% is our sum of every version from 8.1 down).
• Small businesses too. In the government's latest survey, 43% of UK businesses reported a breach or attack in the last 12 months, including 42% of micro businesses (1 to 9 staff) (Cyber security breaches survey 2025/2026).

If your site does not run on PHP, this flaw does not reach it directly. Not sure? Ask whoever hosts it, using the question in step 1. The NCSC also points out that some devices and services may have PHP built in, so if you have IT support, ask them to check those too.

Beware of "urgent security" emails, including ones pretending to be your web company

This part applies whatever your website runs on. Phishing is the most common attack on UK businesses: 38% had one in the last 12 months, and 12% had people impersonating organisations in emails or online (Cyber security breaches survey 2025/2026).

It has happened to us. In September and October 2026, fake emails went out in our founder Sam's name from Gmail addresses. The first said a domain had to be renewed before 28 September or the site would go offline. The second offered a WordPress platform update "ahead of the October 15 deadline". There was no deadline. We build on Next.js, never WordPress, which gave that one away. Check before you act:

• Read the sender's full email address, not just the name. A Gmail or Outlook address claiming to be your web company is a warning sign.
• Be wary of a deadline, a threat that your site will "go offline", or a request to pay, reply or log in.
• Contact the company on a phone number or address you already have, never one in the email.
• Forward suspicious emails to report@phishing.gov.uk, and the NCSC will investigate (GOV.UK).
• If you have already paid or shared bank details, call your bank straight away. If you have lost money or been hacked, report it to Report Fraud on 0300 123 2040 in England or Wales. In Scotland, report lost money to Police Scotland.

We only ever email you from an @brambla.co.uk address, and we never ask for urgent payments, domain renewals or bank-detail changes by email. The full details are on How we contact you.

If keeping up with this feels like too much

Our view: once your host has installed the fixed PHP version and you have updated WordPress and its plugins, you do not need to change platform because of this flaw. But if nobody is really looking after your site, that is worth fixing either way.

Where we stand. The sites we build are custom-built on Next.js and hosted on Vercel, and we do not use WordPress for our builds (How we build). Next.js runs on Node.js, not PHP (Next.js docs), so this flaw does not reach them. No platform is immune, though: in December 2025 a flaw rated 10 out of 10 in React Server Components affected Next.js too (React team). The difference is who is watching. On our plans we run the site for you, security and backups included.

Want to know where your site stands? Our Website Audit has two options. The free Mini Audit checks your homepage's clarity, takes a mobile and speed snapshot and gives a basic SEO overview, with two or three improvements to make straight away. It is not a security check. The £149 Full Website Audit adds a technical health check of hosting, security and outdated plugins, and the fee is credited back if you then start a project with us.

Rather hand it over? Our pay monthly website plans are a free build from £30 a month, and we run the site for you; because the site is part of the service, it comes down if you cancel. Or there is the 7 Day Website from £1,200, run on WebsiteCare from £65 a month. WordPress sites are not part of our standard WebsiteCare plans: if you want us to look after one, we review the site and its hosting first, then give you a quote.

Frequently Asked Questions

Do I need to do anything if my website is on WordPress?

Yes, but it is usually quick: check with your host that your server has the fixed PHP version, then back up and update WordPress, your theme and your plugins.

What PHP version should my WordPress site use?

WordPress recommends PHP 8.3 or greater (WordPress requirements). Whichever version you are on, make sure it has this fix: 8.3.36 or later on PHP 8.3, for example.

When does PHP 8.2 reach end of life?

PHP 8.2 gets security fixes until 31 December 2026. PHP says it "will receive no further security fixes after that date".

Is PHP 7.4 still safe to use?

No. PHP 7.4 reached end of life on 28 November 2022, and PHP says versions this old "no longer receive updates from the PHP project". For this flaw PHP offered only a minimal patch that has to be built into PHP by hand, which is a developer's job. WordPress.org's figures show 16.1% of WordPress sites still run PHP 7.4.

What if my host cannot update PHP straight away?

The NCSC says to apply the temporary workarounds PHP has published, and if that is not possible or would take too long, to consider taking the system offline until it is fixed. If the site stays online without the fix, the NCSC says to check it for signs it has been broken into, such as backdoors (hidden ways back in) left by an attacker.

Related reading

• Website Security Checklist for Small Businesses
• Website Security for Small Businesses: The Complete 2026 Guide
• WordPress vs Custom-Built Websites: Total Cost of Ownership Over 5 Years
• Complete Guide: WordPress Maintenance vs Rebuild: What a Care Plan Never Fixes