What the PHP security alert means for your small business website
Two serious security flaws in PHP, the software that runs underneath nearly every WordPress site, were made public on October 20, 2026. PHP's security team is releasing fixes on October 21, but only for the versions it still supports: 8.2, 8.3, 8.4 and 8.5.
If your site runs one of those, your hosting company applies the fix and you do nothing. If it runs an older version, there is no fix to apply, and the site has to be moved to a newer version.
Most owners don't know which group they are in. This page shows you how to find out and what to do either way.
Your host may have emailed you about this. The email probably mentioned PHP, a version number, and a deadline, and it probably did not explain any of it. That's what this is for. No jargon that isn't explained, and no reason to panic. Owners who act in a hurry make expensive decisions, and this one can be made calmly in a day or two.
What happened, in plain words
PHP is the program your web server uses to turn WordPress into pages. On October 20, 2026, details leaked of two flaws in PHP that let a stranger run their own code on a server, which is the most serious kind of flaw there is.
PHP's security team rated both 9.2 out of 10 and scheduled an emergency release for October 21, 2026 at 14:00 UTC, which is 10am in Boston.
You will see the flaws referred to by their catalogue numbers, CVE-2026-109618 and CVE-2026-109619, and by the nickname "php2shell" that researchers gave them. Both mean the same thing.
On the morning of October 21, Patchstack, a company that tracks WordPress security, reported that some hosting companies were already seeing attacks. watchTowr, the security firm that confirmed the leaked details were genuine, had not seen attacks yet. Reports differ, which is normal in the first day.
The sensible assumption is that attacks will come, and that sites which can't be fixed will be the ones they come for.
One thing worth knowing: this is not a WordPress flaw. It is a flaw in the software WordPress stands on. That matters because the fix is not in your WordPress dashboard. There is no update button for it. The fix is applied by whoever runs the server, which for almost every small business is the hosting company.
How to find out which version of PHP your site runs
Three ways, in order of ease. Email your hosting company and ask; they can see it in seconds. If you can log in to WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section; the PHP version is listed there.
If you have neither a host you can reach nor a login, send us the web address and we'll tell you for free. A site's PHP version is often visible from the outside.
The version number is what matters. As of October 21, 2026, PHP's own support page lists these as the versions still getting security fixes:
| PHP version | Still gets security fixes | Until |
|---|---|---|
| 8.5 | Yes | December 31, 2029 |
| 8.4 | Yes | December 31, 2028 |
| 8.3 | Yes | December 31, 2027 |
| 8.2 | Yes | December 31, 2026 |
| 8.1 and older (8.0, 7.4, 7.3, 5.6) | No | Already ended |
If your site is on 8.2 or newer, skip to the next section. If it is on 8.1 or anything older, skip to the one after. And if you are on 8.2, put a note in your calendar: it stops getting fixes at the end of this year, so the same question comes back in January.
The older group is bigger than most owners expect. Censys, which scans the public internet, found in June 2026 that more than 70 percent of publicly visible WordPress sites were running a version of PHP that no longer gets security fixes, and that 7.4 alone, which stopped getting fixes in November 2022, was still the single most common version at over 20 percent.
If your site was built a few years ago and nobody has touched the hosting since, the odds are that it is in this group.
If you don't know who your hosting company is
This is more common than the guides admit. The three top-ranking guides we read on October 21 were all written by hosting or security vendors, and all three assume you can log in to a hosting account. Many owners can't, because the person who built the site set it up in their own name.
Three places to look: a monthly or yearly charge on your card or bank statement with a hosting company's name on it; your email, searched for "hosting", "invoice" or "renewal"; and the person who built the site, if they still answer.
If none of those works, the host can usually be identified from the web address alone. That is one of the things the free report covers, along with who holds your domain name.
If you're on a supported version: make sure the fix was applied
On PHP 8.2, 8.3, 8.4 or 8.5, your hosting company installs the October 21 fix on its servers; you don't do it yourself. Email them and ask one question: "Has the October 21, 2026 PHP security fix been applied to my site, and when." Keep the reply.
A good host answers the same day. A host that doesn't answer in a few business days is telling you something too.
Two things not to do. Don't install a plugin that claims to fix this; Patchstack specifically warned against unofficial fix plugins and copied code snippets, and a plugin cannot patch the server underneath it anyway.
And don't assume that because the site still loads, the fix is in. A site looks exactly the same before and after a server fix. Ask, and get it in writing.
If you're on an old version: it has to be upgraded, and here is what breaks
A site on PHP 8.1 or older cannot be patched in place, because PHP no longer publishes fixes for those versions. The only remedy is to switch the site to 8.2 or newer, which your host can usually do from its control panel in minutes.
The risk is not the switch itself. It is that an old theme or plugin, written for the old version, stops working when the new one arrives.
Will updating PHP break my site?
Sometimes. WordPress itself copes fine with newer PHP, and so do plugins that someone is still maintaining. The trouble is the ones nobody has updated since the site was built. The jump from 7.x to 8.x is the big one; PHP 8 removed a number of old features, and a plugin written for 7.4 that uses one of them simply stops.
What you see when that happens is one of three things: the whole site shows a blank white page, the site loads but one feature (a form, a gallery, a menu) is gone or shows an error, or the site looks fine and you only find out when a customer tells you the contact form hasn't sent anything in a month.
So before anyone flips the version:
- Take a full backup of the site, files and database both, and confirm you know where it is and who can restore it. Not a backup the host "probably" has. One you can point to.
- Ask the host whether they can test the new version first, or switch it back quickly if something breaks. Most control panels can switch back in a minute. Make sure yours can before you start.
- Switch, then check the site yourself within the hour: the home page, every page in the menu, and send a test through the contact form to make sure it arrives.
- If something broke, the usual culprit is one plugin or the theme. If you have a login, turning plugins off one at a time finds it. If you don't, the host can do that for you, and this is the point where many owners discover their "web guy" set the site up in a way nobody else can get into.
If the site breaks and the person who built it is gone, you have two honest options. Pay someone to fix or replace the old plugin or theme, which keeps you on WordPress and means doing this again at the next update. Or treat this as the moment to stop. That is the next section.
Why this keeps happening to WordPress sites, and the one way to stop dealing with it
A WordPress site is not just pages. It is a stack of software: PHP underneath, WordPress on top of that, a theme on top of that, and usually a long list of plugins, each written by a different company and each needing updates forever. Every layer is something that can be broken by an update or broken into by a stranger.
A site rebuilt as plain pages, with no software running inside it, has nothing in that stack left to break. Flaws like this week's stop being your problem, permanently.
This is the honest part, and it is also what we sell, so weigh it accordingly. A brochure site, meaning pages with your hours, your menu or services, photos, and a contact form, does not need software running inside it at all. It needs the pages.
Anvil takes a full copy of your WordPress site, keeps it safe, and rebuilds the same pages with nothing underneath them to update, patch or log into. To your customers it is the same site, at the same web address.
To you it is $59 a month for hosting, a person who answers by the next business day, and no more emails from your host about version numbers.
It is not for everyone. If your site has an online store, a patient portal, logins or built-in booking, you need software inside it, and you need someone keeping that software current. We don't do those, on purpose. If that's you, the right move is the upgrade path above, with a maintenance plan you can actually reach a human on.
For the rest, this week is a fair moment to ask why your site needs a babysitter at all. Here is how the rebuild works and what it costs.
Short answers to the questions owners are asking this week
Does PHP 7.4 get a security update for this
No. PHP 7.4 stopped receiving security fixes in November 2022, and PHP publishes fixes only for the versions it still supports, which on October 21, 2026 are 8.2 through 8.5. A site on 7.4 has to be moved to a supported version; there is nothing to apply in place.
My host says I have to update PHP by a certain date
Hosts are using this week to force the move they have been putting off, and many will switch old sites to 8.x automatically over the coming weeks. That is reasonable of them, but it means the "what breaks" section above may happen to you without warning. Take the backup now, while you can still choose the timing.
The site still works, so it's fine
A site with an unpatched flaw looks identical to one without. The flaw lets someone else use your server; it does not announce itself. "It still loads" tells you nothing about whether the fix is in.
I have no login and no idea who the host is
Then start with the free check below. We'll tell you the PHP version if it's visible, who the host appears to be, and who holds your domain name, so you know where you stand before you spend anything.
Free check: is my site on a version that still gets fixes
Send the web address and an email. Dan looks at the site by hand, usually within a few business days, and writes back with the PHP version if it's visible, who the host and domain registrar appear to be, and what we'd do about it, if anything.
If you're fine where you are, the reply says so.
Got it.
Dan will look at your site by hand and reply to your email, usually within a few business days. If there's a wait, you'll get a short note saying how long.
Anything urgent in the meantime: dan@anvilsites.io
Or skip the form and email Dan directly: dan@anvilsites.io
Sources
- PHP security team, "Upcoming Critical PHP Security Release," php.net news, October 20, 2026. Two flaws rated CVSS v4.0 9.2; release scheduled for October 21, 2026 at 14:00 UTC.
- PHP, "Supported Versions," php.net, read October 21, 2026. Branches 8.2 to 8.5 supported; 8.2 security support ends December 31, 2026.
- Patchstack, "Major security alert," patchstack.com, October 21, 2026. Reports of exploitation from hosting partners; warning against unofficial fix plugins.
- watchTowr, PHP CVE-2026-109618 FAQ, read October 21, 2026. Confirmed the leaked details; no exploitation observed at time of reading.
- Censys data reported by SecurityOnline, "WordPress Sites at Risk: Outdated PHP, Plugins, and Default Configs," July 8, 2026. Over 70 percent of publicly visible WordPress sites on end-of-life PHP; 7.4 the most common version at over 20 percent.
This page will be updated if PHP's published list of affected versions changes what's written here. Nothing on it is legal or security advice for your specific situation; it is the plain-English version of what the official notices say, written for owners who got the email and didn't know what it meant.