A Critical PHP Flaw Hit the Web: Is Your Website Safe?

This week, security researchers disclosed a serious problem in PHP, the software that quietly powers a huge share of the websites on the internet. It is the kind of news that makes headlines in tech circles and then never reaches the people it affects most: small business owners who have a website and assume someone, somewhere, is keeping it safe.

If that is you, this is worth three minutes. You do not need to understand the technical details. You just need to know whether your site is exposed, and what to do about it.

What actually happened

On October 21, 2026, two critical flaws in PHP were made public. Security teams are calling them “php2shell.” They are rated 9.2 out of 10 on the industry severity scale, which is about as high as it gets.

In plain terms: these flaws can let an attacker take control of a website’s server without needing a password or any login at all. From there they can steal customer data, deface your pages, redirect your visitors, send spam in your name, or quietly plant malware that gets your site flagged by Google.

This is not a theoretical, “maybe someday” risk. Researchers at firms like Palo Alto Networks estimate more than 22 million websites were potentially exposed, the technical details leaked online before a fix was ready, and working attacks have already been confirmed against real applications. When that happens, automated scanning of the whole internet usually follows within days.

Why you should care, even if nothing looks wrong

Here is the part that catches owners off guard: a site can be compromised and look completely normal to you. The damage happens behind the scenes. You often find out when a customer tells you their card was charged by someone else, when your email starts landing in spam, or when Google slaps a red “this site may be harmful” warning in front of your visitors.

By then the cleanup is expensive and your reputation has already taken the hit. Prevention is a software update. Recovery is a project.

Is your website affected?

This particular flaw is in PHP, so the answer comes down to one question: does your site run on PHP?

You are likely running PHP, and should pay attention, if your site is built on:

• WordPress (by far the most common, it powers roughly 4 in 10 websites)
• WooCommerce, Magento, or other PHP online stores
• Drupal or Joomla
• A custom site a developer built in PHP or Laravel

Not every website runs on PHP, and sites that do not are not exposed to this particular flaw. The catch is that most small business websites, especially anything built on WordPress, do run PHP, so most owners are not automatically in the clear.

If you are not sure what your site is built on, that uncertainty is exactly the problem this post is about.

How to tell in a couple of minutes

You do not need to be technical to get a rough answer:

1. Think about how you edit your site. If you log into a “wp-admin” dashboard, you are on WordPress, which is PHP.
2. Ask who hosts and maintains it. If you pay a host like Bluehost, SiteGround, GoDaddy, or Hostinger, you are almost certainly on PHP.
3. Ask when PHP was last updated. If the honest answer is “I have no idea” or “never,” your site may be running a version that no longer receives security fixes at all.

That last point matters. Older versions of PHP (8.1 and earlier) have reached end of life, which means they get no official fix for this flaw. Sites stuck on them cannot simply be patched. They have to be upgraded.

What to do right now

If your site runs PHP, this is the short version of what needs to happen:

• Update PHP to a patched version (8.2.35, 8.3.36, 8.4.27, or 8.5.12, or newer). On many hosts this is a setting, but it needs to be done carefully so it does not break your site.
• If you are on an old, unsupported version, plan an upgrade now. A patch is not available for you, so waiting only increases the risk.
• Make sure something sits in front of your site to filter malicious traffic. A web application firewall can block the known attack pattern while updates roll out.

If reading that made your eyes glaze over, that is a completely reasonable reaction. Most business owners did not start a business to track PHP version numbers. You should not have to.

The real lesson: a website is not “set and forget”

The uncomfortable truth is that a website is more like a car than a painting. A painting you hang once and forget. A car needs oil changes, or eventually it fails at the worst possible moment. Websites run on software, and software needs regular updates to stay secure. Skip them long enough and a day like today turns a routine update into an emergency.

This is the single most common gap we see with small business sites: they were built once, launched, and then left alone for years. No updates, no monitoring, no one clearly responsible. It works right up until it does not.

How we can help

This is exactly the kind of thing we handle so you do not have to think about it.

Free website vulnerability check. Send us your website address and we will tell you, honestly, whether you appear to be exposed to this PHP flaw and what shape your site is in overall. No pressure and no jargon, just a straight answer.

Ongoing maintenance. If you would rather never get surprised by news like this again, we keep your site updated, monitored, and patched so these issues get handled before they become your problem. And if it is time for a fresh start, we build on modern, secure foundations that are not exposed to attacks like this one in the first place.

We are based in Freeport and serve small businesses across Orlando and Central Florida. You keep running your business. We will keep your website safe.

Get your free vulnerability check and stop wondering whether your site is one of the millions at risk.