A Critical PHP Security Update Is Landing Today. Here Is What It Means for Your Site.

Most websites run on a piece of software called PHP. You never see it, but it works quietly in the background, a bit like the engine under a car's hood. Today the people who make PHP are releasing an urgent repair for a newly found security problem. If your website or app runs on PHP, here is what it means, in plain English.

The short version:

• A serious security hole was found in PHP, the software behind most websites.
• An official fix is being released today. Every PHP site should have it applied soon after.
• If we build or host your site, we are already on it. You do not need to do anything.

What actually happened?

PHP powers a huge share of the world's websites, including WordPress and most custom-built apps. Its makers found two serious security flaws and are rushing out an emergency fix today, Wednesday 21 October 2026.

"Serious" here is not marketing language. These are the kind of flaws that, left unpatched, could let an attacker into a website. That is why it is worth handling quickly, rather than leaving for next month.

Is this serious, or just hype?

It is serious. These are among the most severe kind of security flaws, and PHP is rushing out an emergency fix for good reason. Please do not wave this one away.

That said, two things are getting mixed together online, and it helps to keep them apart. One is the real problem, which PHP has confirmed and is fixing today. The other is the noise around it: dramatic headlines, forum threads, and people claiming to have a ready-made way to break in. The first is worth your full attention. The second is unverified, and chasing it only causes panic or mistakes.

For you as a site owner, the takeaway is simple. This is real, it matters, and the fix needs to be applied quickly. We are acting on the confirmed problem, not on the noise.

Does this affect my site?

If your site runs on PHP, and most sites do, then yes, it needs the fix once it is out. The good news is that for most of our clients this is a quiet background job that we take care of. You will not have to lift a finger.

What if my site runs an older version of PHP?

This is the one part worth reading twice.

PHP only releases fixes for the versions it still looks after. Today that means PHP 8.2 and newer. Older versions, like PHP 8.1 or anything on PHP 7, have been retired. They will not get this fix at all.

So if your site is on an old version, you cannot simply "apply the patch," because there is no patch coming for it.

A few things to keep calm about:

• Being on an old version does not mean your site has already been hacked. It means a door may be unlocked, not that someone has walked through it.
• The real fix is to move your site to a current, supported version of PHP. If this is you, treat it as the push to finally do it. We can handle the move for you.
• If an upgrade cannot happen right away, we can put temporary protections in place. That is our job, not something to attempt yourself.

If you are not sure which version your site uses, that alone is a good reason to message us. We will check for you.

What we are doing

• Watching for the official fix. We will know the moment it is released.
• Applying it for every site we host or manage, as soon as it is tested and safe. You do not need to do anything.
• Telling you directly if your site needs a decision from you, or a short pause for maintenance.

What you should do

• If we host or manage your site: nothing. It is handled, and we will confirm when it is done.
• If someone else hosts it: send them one message today. Something like: "There is a critical PHP security fix out today. Can you apply it as soon as possible?"
• If you are not sure who looks after your site, or which PHP version it runs: ask us. Checking is free.

One thing to avoid

Alongside the news, someone is handing out a so-called "hacking tool" and encouraging people to run it. Do not download it. Do not run it. Do not forward it to anyone technical "just to test."

Tools like this, passed around during a security scare, are one of the most common ways sites get broken into. The only safe move is to apply the official PHP fix when it lands, and we will handle that for the sites we run for you.

Where to read more

Want to check the facts yourself? These are the official, trustworthy sources. We would ignore the exploit write-ups and social media threads going around.

• PHP security announcements. The official page from the PHP project.
• Latest PHP news and releases. Where today's fix will be posted.
• Supported PHP versions. The official list of which versions still get fixes.

This advisory reflects what was publicly known on 21 October 2026, before the release. We will update it once PHP publishes the full details.