If your news feed had the word “PHP” in it this week, you’re not alone. Security agencies worldwide issued alerts, tech headlines called it a big deal, and many website owners were left wondering whether they should be worried.
Below I’ll explain what PHP is, what happened, and how to tell whether any of this affects you.
So, what the heck is PHP?
PHP (PHP: Hypertext Preprocessor) is a programming language that runs behind the scenes on a website’s server. When someone visits your site, PHP often builds the page they see: pulling in your blog posts, loading your contact form, or showing the latest events.
You’ve probably never seen it, and that’s the point. If your site runs on WordPress, it runs on PHP. The same goes for Drupal, Joomla, and many custom-built sites. PHP has been around since the 1990s, and it still powers much of the internet.
Think of it like the plumbing in a house. You don’t think about it day to day, but when a pipe cracks, you want it fixed fast.
What happened this week
On October 20, the PHP team warned website administrators that two critical security flaws were coming to light and that emergency fixes would follow. Some details leaked online ahead of the official disclosure, and the fixes were released on October 21.
The flaws are serious because, under certain conditions, an attacker could use them to take control of a website’s server in at least one common server setup, and this can happen without a password or login. Security researchers believe older PHP versions are affected too, and attack traffic was reported before the fix was even out. That’s why government cybersecurity agencies, including Canada’s Cyber Centre, told organizations to update right away.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For the technically curious, the flaws are tracked as CVE-2026-109618 and CVE-2026-109619.
Is my website affected?
It depends on how your site is built and who runs the server. Here’s a general guide. When in doubt, your host or platform’s support team can confirm for your specific site.
| Host or Platform | Do I need to update? | Next Steps |
| WordPress, Drupal, or Joomla on regular web hosting (GoDaddy, Bluehost, SiteGround, etc.) | Yes, likely | Make sure PHP has been updated to a patched version |
| On a managed WordPress host (WP Engine, Kinsta, etc.) | Usually handled | Your host typically patches the server, but it’s worth confirming |
| On PHP 8.1 or older | Yes, and harder to fix | These versions no longer get fixes, so the site needs a PHP upgrade |
| Built on Squarespace, Wix, or Shopify | No action needed | The platform manages its own servers, so updates like this are on their end |
| A static site (plain HTML) | No | Nothing to do |
That PHP 8.1-and-older row is the one to watch. Moving to a newer PHP version can break older themes or plugins, so it’s a project, not a quick patch.
What you should do
- Find out what your site runs on. If you’re not sure, your web designer or hosting company can tell you in a minute.
- Check your PHP version. Most hosting dashboards make this easy to access. The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, or newer. If your number is lower, don’t panic: some hosts apply the fix without changing the version number, so ask them whether your server has been patched.
- Update, or ask your host to. Many hosts have already patched their servers, but don’t assume. A quick support ticket will confirm it.
- Plan an upgrade if you’re on PHP 8.1 or older. Schedule it soon and test your site afterward.
- Watch for anything odd. Strange new pages, unfamiliar admin accounts, or a sudden slowdown are worth a second look.
Need a hand?
If I manage your website and you’ve heard from me this week, you’re already taken care of. Your site has been updated.
If you’re not sure where your site stands, or you’d just like someone to check, get in touch. I’m happy to answer questions and help get things updated.
Updates like this are a normal part of owning a website, and staying on top of them is one of the easiest ways to protect your work and the people who visit your site.