The critical PHP update: what to change this week

You are reading this because your business has a website, a shop or a tool, and most of those run on PHP. This week PHP published an emergency security release. I run Marketive Hub on my own and I am not a security firm, so everything below comes from the official sources, linked at the end, plus practical checks anyone can do.

The facts

Sources: PHP's 2026 news archive and CISA's alert. CISA's advice is short: apply the patch immediately, starting with systems that face the internet.

What it could mean for your business

I cannot tell you that any particular site has been attacked. I can tell you what this kind of flaw allows. Someone who can run code on your server can, in principle:

• Change your pages. Someone with code access can edit your pages or add pages you did not write.
• Read what the server holds. That can include orders, enquiries and customer details.
• Use your server. It can be used to send spam or to attack other sites.
• Get your site flagged. Hosts, browsers and search engines can warn people away from a site they think is compromised.

There is a marketing cost too. If the site goes down or gets flagged, your ads keep running and keep spending. Every click you pay for lands on a page that may not work. That is the part of this I see on the marketing side, and it is why I take it seriously.

Is your website affected?

It is if it runs on PHP. WordPress, WooCommerce, Magento, Drupal, Joomla, PrestaShop and many custom-built sites and old tools do. A plain HTML site does not, and neither does a site on a platform where the provider runs everything and you never touch a server. In that case it is the provider's job, but it costs you one email to ask.

Two things people forget: old microsites and staging copies that nobody looks at any more, and software with PHP built in. CISA's advice is to list every system that runs PHP, including PHP embedded in other software.

What to change this week

• Make a list. Every website, shop, booking tool, form handler, client portal and internal tool that might run PHP. Note who hosts each one.
• Find the PHP version. In WordPress, open Tools, then Site Health, then Info, then Server. Your hosting panel usually has a PHP version setting too. If you cannot find it, ask your host.
• Check it against the fixed versions. 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and newer are fixed. Some hosts patch older branches themselves, so the version number may not show it. Ask for it in writing.
• Plan the move off old versions. Pick the newest branch your plugins and theme support, and test it on a copy of the site first.
• Do not rely on tweaks. A web application firewall may add some protection, according to CISA, and PHP lists settings that reduce exposure. Neither is a fix. Update.
• Know who watches. CISA suggests monitoring for PHP processes starting shells or downloading tools. That is a job for your host or IT person. If you cannot update straight away, or you are on PHP 8.1 or older, CISA's alert advises taking the PHP system offline until it is updated.

For the technical readers: on 23 October PHP published a separate note about a lower-risk issue, CVE-2026-115560. It is to be fixed in the next regular release, and PHP suggests setting session.upload_progress.enabled=0 until then.

Three questions to email your host or developer today

1. Which PHP version does each of our websites and tools run?
2. Has the 21 October security fix been applied (PHP 8.5.12, 8.4.27,
   8.3.36 or 8.2.35, or a vendor backport)? On which date?
3. If we are on PHP 8.1 or older, what is the plan, and by when?

Keep the answers. If the replies are vague, that is information too.

Or let me do the check

You can do all of the above yourself. If you would rather not, this is what I do, and what it costs:

• Step 1, free. A 30-minute call. You tell me what you run and where it is hosted.
• Step 2, free. Within 48 hours you get a written audit, yours to keep. It lists your sites and tools, the PHP version of each where I can see it, what is on an unsupported version, and the work in priority order, so the shop that takes orders comes before the old microsite.
• Step 3, only if you want it. I plan and run the upgrade, testing plugins and themes on a copy first. Paid work starts from €100 and is scoped before you agree. There are no long-term contracts.

After that I can stay on as your maintenance and support, which is part of my IT Services. Ongoing support runs month to month with 30 days' notice either side. I can also write the one-page routine for the next critical update: who hears about it, who checks, who signs off. I build routines like that for clients. At T&V Advertising, written SOPs and standard project phases made delivery 35% faster and cut onboarding for new team members from three months to three weeks (the case study, and how we measure says what those figures count). That figure is for their delivery work, not for security.

Why me: you work with me directly and have one point of contact, and I reply within 24 hours. Specialist contractors sometimes handle production work such as development, but your account is never passed to a junior. My own site is static HTML with a small Node.js back end and has no PHP in it. What I do not do is incident response and forensic clean-up. If you think a site has already been hit, call your host first. They can see the server and the logs, which I cannot.

Questions

My site is on WordPress. Am I affected?

WordPress runs on PHP, so it is in scope. Whether you are exposed depends on the PHP version your host runs and whether the fix has been applied. Ask the host. Take a backup first, then update WordPress, plugins and PHP, testing as you go.

Can I just change a setting instead of updating?

PHP lists settings that reduce exposure for each flaw, but its own notes say there is no complete mitigation and that updating is the only safe choice. Settings are for buying a few days, not for staying put.

What if I am on PHP 8.1 or older?

PHP no longer releases regular updates for those branches and offers only minimal source backports, meant for people who build PHP themselves. Some distributions and vendors ship their own backported fix, so ask your host in writing. CISA's alert advises taking PHP systems on 8.1 or older offline until they are patched or updated. Plan the upgrade now.

What does your check cost?

The call and the written audit are free. Paid work starts from €100, is scoped before you agree, and only happens if you want it.

Want me to look at your setup?

Tell me what you run and where it is hosted. In 30 minutes I will tell you honestly what I would check first.

Yes, let's start: book your free 30-minute call. I look at your setup first, and within 48 hours you get a written audit, yours to keep. No card, no contract.