October's website scare: what small businesses should do now

What happened in October

On 21 October 2026 the PHP project released urgent fixes for two serious flaws in PHP, the software that runs underneath most small-business websites, including almost every WordPress site. Either flaw let a stranger take control of a web server without logging in¹. The flaws were nicknamed PHP2Shell.

The US Cybersecurity and Infrastructure Security Agency (CISA) told organizations to install the fixes immediately, and said anyone on an older version that couldn't be fixed should take those websites offline². On 26 October it added both flaws to its list of flaws being used in real attacks³.

Who was affected

Many large sites went offline for hours or days, mostly as a precaution while they updated. A public tracker listed 753 of them, from Wikimedia services and the Internet Archive to government portals across Europe⁴⁵.

Most small businesses heard nothing about it. Their website's host either installed the fixes quietly, or didn't. From the outside you usually can't tell which, and that's the real problem: if you don't know what your website runs on, you can't know whether it was fixed.

Three questions to ask whoever looks after your website

They take one email, and the answers tell you a lot.

1. "Was our site updated after the PHP security fixes on October 21?" If the answer is "what fixes?", that's an answer too.
2. "Which version of PHP does our site run on, and when does it stop getting security fixes?" PHP 8.2 stops getting them on December 31, 2026⁶. Versions 8.1 and older already have.
3. "If you were unavailable for a month, who else could update our site?" Many small-business sites depend on one person, and that's fine until they're busy or move on.

Keep the answers. They're the start of a plan, whatever you decide.

Your options

Keep the site, and keep it updated. If the answers are good, this is a fine choice. It means updates every month, and a plan for moving off PHP 8.2 before the end of the year. Agencies typically charge $199 to $499 a month to look after a site this way⁷.

Rebuild on the same kind of setup. A new WordPress site looks better and starts on current software, but it has the same need for monthly updates, and the next flaw like this one will need fixing too.

Move to a site with nothing to patch. A static site serves ready-made pages, with no PHP or database on the public server. There was nothing to update in October, because there was nothing there to attack. It's also faster on a phone, and your staff can still edit it. That's how we build our sites. Our prices are fixed and start at $2,900, with hosting included.

For whoever looks after your website

• The flaws: CVE-2026-109618 and CVE-2026-109619, unauthenticated remote code execution. PHP says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php (the highest risk), php-cgi, FrankenPHP and LiteSpeed².
• The fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says there are no complete mitigations, and updating is the only safe choice¹.
• Older versions: PHP 7.4, 8.0 and 8.1 got no official release. The PHP security team published minimal source backports for people who build PHP themselves¹. A server on one of them should be moved to a supported version.
• Check the real version. Ask the host, or run php -v and check phpinfo() on the server itself. A version in the X-Powered-By header is a clue, not proof: many hosts hide it, and some backport fixes without changing the number.
• Look for signs of trouble. CISA advises checking for PHP worker processes that start shells or download tools². If the site wasn't updated until days after 21 October, review its files and accounts, not just the version.
• Plan for 31 December 2026. PHP 8.2 reaches end of life then⁶. Plan the move to 8.4 or 8.5 now, and test plugins and themes on it first.