PHP Security Vulnerability 2026: Is Your Website at Risk?

Critical Website Security Warning PHP: Is Your Website at Risk?

Recent critical security vulnerabilities in PHP, one of the technologies powering a HUGE proportion of the internet, are a timely reminder that website security should never be taken for granted.

On 21 October 2026, the PHP development team released emergency updates addressing two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619—which impact “all PHP installations serving web requests” going back to PHP version 5, released in July 2004. However, only PHP 8.2 and newer are still supported and will receive patches, according to the alert.

That could allow attackers to execute malicious code on affected servers without authentication. The vulnerabilities were rated 9.2 out of 10 for severity, and organisations were urged to update immediately. Read the official PHP security announcement.

Why should small businesses be concerned?

PHP runs behind many popular websites and platforms, including WordPress. When vulnerabilities are discovered in the underlying technology, websites running outdated or unsupported versions can be left exposed. For example do you know what PHP version you are running on your website and do you immediately know if you are at risk?

For small businesses, a website is often one of their most important assets. It represents your brand, attracts potential customers and helps generate enquiries. But if it hasn't been maintained properly, it could also become a security risk.

An outdated website can expose your business to risks such as:

• Security breaches: attackers exploiting outdated software, plugins or themes.
• Data exposure: sensitive information potentially being accessed by unauthorised parties.
• Website downtime: your website being taken offline or disrupted.
• Damage to your reputation: customers losing confidence if your website is compromised.
• Unexpected costs: recovering a hacked website can be expensive and time-consuming.

The biggest warning sign isn't necessarily which platform your website uses. It's whether anyone is actively looking after it.

Is it time to move away from WordPress?

WordPress powers around 40% of all websites, making it an enormously popular platform. However, its flexibility often relies on a combination of core software, themes and third-party plugins. Each component needs to be assessed and maintained appropriately.

WordPress can be secure when properly configured and regularly updated. But if your website relies on outdated plugins, unsupported software or a maintenance routine that has been forgotten, it's worth asking whether your current setup is still right for your business.

A bespoke website could offer a better long-term option.

At Vassel Creative, I build bespoke websites around the specific needs of your business, rather than relying on a large collection of off-the-shelf plugins to deliver every feature.

A carefully planned bespoke website can offer:

• Less unnecessary complexity: only build the functionality your business actually needs.
• Greater control: choose the technologies and architecture that suit your requirements.
• A tailored experience: design and functionality built around your customers and goals.
• A stronger foundation for the future: make informed decisions about performance, security, accessibility and ongoing maintenance.

No website is automatically secure simply because it's bespoke. The underlying technology, hosting, configuration and ongoing updates still matter. The aim is to build a site that's appropriate for your business and easier to manage responsibly over time.

Don't wait until something goes wrong

If your website hasn't been reviewed recently, now is a good time to take action.

Check that your software and dependencies are supported, your hosting environment is up to date, backups are working and security updates are being applied. If you're unsure what your website is running or who is responsible for maintaining it, get it checked by a qualified developer.

For websites running PHP, the current emergency advisories make this especially urgent. Site owners should contact their hosting provider or developer to confirm that the relevant security updates have been applied as soon as possible.

‘What shall I do now?’

Firstly, importantly get in touch with whoever is hosting or running your website. Even if you are reading this a few days later, establish what measures are being taken to mitigate security incidences on your website. Your Website developer should have the answers. Here is a quick Copy and Paste Email.

Subject: Urgent Security Inquiry: PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 / php2shell)

Hi [Name / Support Team],

I hope you're well.

We are writing to urgently check on the security of our server environment in light of the recently disclosed critical "php2shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619). These flaws allow unauthenticated remote code execution and affect a massive range of PHP versions.Because we want to ensure our website, user data, and server are completely secure against active exploits, could you please confirm the following for us:

1. Current PHP Version: What exact version of PHP is our website currently running on, and is it actively supported with official security patches?
2. Immediate Vulnerability Mitigation: Have the necessary server-side mitigations (such as disabling session.upload_progress.enabled) or vendor-backported patches been applied to our environment to block this specific exploit?
3. Server Privacy: Is our server configured to hide the X-Powered-By header so that our underlying technical infrastructure and version numbers are completely hidden from public malicious scans?
4. Lifecycle & Upgrade Plan: If we are currently running on an end-of-life (EOL) version of PHP, what is your recommended timeline, process, and cost to safely upgrade our site to a modern, actively supported version (such as PHP 8.2 or higher)?

Given the severity of this zero-day issue and the availability of public exploit tools, please let us know as soon as possible what steps have been taken to secure our site.Best regards,[Your Name]
[Your Company / Website URL]

Let's build a website that's ready for the future

Your website should help your business grow, not leave you wondering whether it's secure, outdated or holding you back.

If you're running an old WordPress website, struggling with ongoing maintenance or considering a fresh start, this could be the ideal opportunity to review your options.

At Vassel Creative, I create bespoke websites for small businesses that combine considered design, performance and a solid technical foundation.

Get in touch today to discuss your current website, explore a bespoke alternative and take the next step towards a website built for your business and its future.

The next few nights shall be long ones for the internet, sleep with peace of mind knowing your website is in safe hands. hello@vasselcreative.com