The 2026 PHP Security Flaw: What It Means for Your Website

On 21 October 2026, government websites in the Netherlands, Finland, France, Canada and Australia went dark on purpose. Officials switched them off while they installed an emergency fix for a critical PHP security flaw, two bugs that had been sitting in the language behind most of the web for years. If your business website runs on WordPress, WooCommerce, Laravel, Magento or any custom PHP code, this story is about you. Here is what happened, how to check whether you are exposed, and exactly what to do about it.

What happened

PHP is the programming language that powers a large share of all websites, including every WordPress site. On 21 October the PHP team released fixed versions for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. According to security reporting, the flaws affect every PHP version since 5.4, which means almost any PHP website built in the last decade. The bugs were discovered with the help of AI, after going unnoticed by humans for years.

Because the fix was public, attackers could study it and work out how to exploit unpatched sites. Cloudflare reported attacks emerging within hours and updated its firewall rules as a stopgap. The US National Security Agency and CISA told organisations to update immediately or take affected systems offline until they could. Several governments chose the second option, which is why so many official sites showed error pages that day.

Which websites are affected

Any site that runs PHP on the server, which includes:

• ✦WordPress and WooCommerce sites, including most small business and restaurant sites in India.
• ✦Shopify is not affected: it runs on Shopify's own servers, not PHP. Your custom Shopify theme is safe.
• ✦Laravel, CodeIgniter and other PHP frameworks used for custom web apps, booking systems and portals.
• ✦Magento and OpenCart stores.
• ✦Older custom-built sites on shared hosting, which are often the most neglected and the most exposed.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your site runs PHP 8.1 or older, there is no fix for your version at all, because those versions no longer receive security updates. The only safe move is to upgrade.

How to check your site in two minutes

1. 1WordPress: go to Tools, then Site Health, then the Info tab, and open Server. The PHP version is listed there.
2. 2cPanel hosting: open 'MultiPHP Manager' or 'Select PHP Version' to see and change the version for each domain.
3. 3Managed hosting (Hostinger, Cloudways, WP Engine, Kinsta and similar): check the dashboard for a PHP version setting and any security notice they posted this week.
4. 4Custom sites: ask your developer for the output of 'php -v' on the server, or look for a notice from your hosting provider.

If the version shown is lower than the fixed versions above, your site is exposed until it is updated.

The fix, in order

1. 1Back up the site and the database first. A backup from before the update is your safety net if anything breaks.
2. 2Update PHP to a fixed version: 8.3.36 or 8.4.27 are the sensible choices for most sites today.
3. 3Update WordPress core, every plugin and every theme. Delete plugins and themes you no longer use; inactive code is still attackable.
4. 4Turn on a web application firewall. Cloudflare's free plan or a security plugin such as Wordfence blocks known attack patterns while you work.
5. 5Check for signs of compromise: unknown admin users, files modified in the last week, redirects to strange sites, or Google Search Console warnings.
6. 6Change the passwords for the admin accounts, the hosting panel and the database if there is any sign the site was touched.
7. 7Test the site on a phone and a desktop after the update. A PHP upgrade can break very old plugins, which is exactly why step one matters.

Why 'my hosting handles it' is not enough

Good hosts did patch their servers this week. Many cheap shared hosts did not, or only patched the default version while your site sits on an older one you selected years ago. Hosting providers also cannot update your plugins or remove the abandoned theme from 2019 that is still on the server. The server is their job; your website is yours.

What this means for Indian businesses

No report so far names Indian government sites among those taken offline, but the exposure is the same everywhere. Most small business websites in India are WordPress sites on shared hosting, built once and rarely maintained. They are exactly the kind of target that gets hit in the weeks after a flaw like this, not by someone choosing your business, but by automated scans that try every PHP site they can find. If you take payments, store customer details or run bookings through your site, treat this as urgent.

The bigger lesson

A website is not a one-time purchase. It runs on software that needs updates, the same as your phone. Two habits remove most of the risk: a monthly maintenance routine that updates PHP, core, plugins and themes, and a modern build that depends on as little old software as possible. The sites we build today run on actively maintained frameworks with security and speed built in, and every client site is on a maintenance plan, so a week like this one means a short check, not a crisis.

If you are not sure where your site stands, send us the link. We will check the PHP version, the plugins and the speed, and tell you plainly whether it needs an update, a cleanup or a rebuild. The check is free, and this week it is worth doing today rather than next month.