PHP Security Patches: What Business Website Owners Should Check Now

Business website owners should check every server running PHP, apply the emergency security updates, and confirm that unsupported versions are no longer in use. Two critical flaws disclosed on October 21, 2026, may let attackers reach a website backend without a password or login, so internet-facing systems deserve immediate attention.

The flaws affect PHP, a programming language used by many websites and business tools. The Cybersecurity and Infrastructure Security Agency, National Security Agency, and Federal Bureau of Investigation advised organizations to patch promptly, then take vulnerable systems offline if they cannot update right away.

Why This Requires Immediate Attention

A website can remain online while its PHP runtime stays hidden from ordinary visitors. That makes this issue easy to miss during a normal visual review, even though the server may still run exposed software.

An attacker who reaches the backend could alter pages, steal information, create administrator accounts, or use the website against visitors. The recommended fix is direct: identify each PHP system, install the vendor's security update, and verify the result with the hosting provider or web team.

Public reporting said CISA had not observed exploitation when it issued its warning. That does not remove the need to patch, because internet-facing vulnerabilities can become more dangerous after technical details spread.

Start With a Complete PHP Inventory

Many businesses know which website they manage but not every system connected to it. A server may run PHP for the public website, an administration panel, a private portal, a form handler, or an older application.

Ask the hosting provider or technical team for a written inventory covering every production and test system. Include separate servers, staging sites, backup environments, and business tools that process forms or customer information.

• Record the server or hosting account connected to each website.
• Record the PHP version running on each system.
• Mark whether the system is accessible from the public internet.
• List the website, application, and database connected to each server.
• Record the person or provider responsible for applying updates.

Do not rely on the version shown inside a website dashboard. The server's active PHP version controls the exposure, and a hosting panel may display different settings from the application itself.

Apply the Security Update

Once the inventory is complete, patch public-facing systems first. Use the PHP release recommended by the hosting provider, application vendor, or technical team, and confirm that the update includes fixes for the two critical flaws.

Before changing production software, create a tested backup of the website files and database. Store the backup separately from the live server, then confirm that it can be restored rather than assuming a completed backup is usable.

1. Save a current backup of files and databases.
2. Confirm the PHP version and operating system support the planned update.
3. Apply the update through the hosting control panel or server management process.
4. Test the public website, administration area, forms, payments, search, and scheduled tasks.
5. Record the update date, new version, test results, and person responsible.

A patch can expose older application problems, especially when a website has not received regular maintenance. If a function stops working, keep the patched runtime in place and correct the incompatible code instead of reverting to the vulnerable version.

Handle Unsupported PHP Versions

PHP 8.1 and older versions no longer receive official security updates. Continuing to run one of these versions leaves the business dependent on old software that cannot receive current protection.

The next step is an upgrade plan that covers the application, extensions, database connection, and hosting environment. Test the plan on a separate copy first, then schedule production work after the main functions pass review.

If an unsupported system cannot be upgraded promptly, restrict or remove its public access. CISA, the NSA, and the FBI recommend taking vulnerable systems offline until they can be patched or upgraded.

Check for Signs of Unauthorized Changes

Patching stops the known software weakness, but it does not prove that no one accessed the system earlier. Review the website and server for changes that the business did not approve.

• Look for administrator accounts that no one recognizes.
• Review recently changed files and unexpected scheduled tasks.
• Check for unfamiliar redirects, pages, scripts, or downloads.
• Review server, hosting, and administrator login records.
• Look for unexpected crashes, restarts, or changes in email behavior.

If anything looks suspicious, preserve logs and a clean backup before deleting files. Disconnect the affected system when practical, change credentials from a separate trusted device, and have qualified security staff examine the server.

Strengthen the Recovery Plan

A secure website also needs a recovery process that works during an outage. Confirm that backups run automatically, remain separate from the production server, and include both website files and databases.

Test restoration on a separate environment at least once. The test should show how the business will restore the website, verify forms and transactions, replace compromised credentials, and return the system to normal operation.

CISA's small-business guidance also recommends basic controls such as software updates, strong passwords, multifactor authentication, and phishing awareness. Apply those controls to hosting accounts, domain management, email, administration panels, and backup storage.

A Short Checklist for Owners

Use this list to confirm that the work is complete:

• Every PHP system has an identified owner.
• Every public-facing system has a supported and patched PHP version.
• Unsupported PHP versions have an upgrade plan or are offline.
• Backups exist outside the live server and have passed a restoration test.
• Administrator accounts, files, tasks, and logs show no unexplained changes.
• Hosting, domain, email, and website credentials use strong passwords and multifactor authentication.
• The update record includes versions, dates, tests, and follow-up work.

This PHP issue is a reminder to treat the server runtime as part of the website, not as a hosting detail. A current inventory, prompt patch, supported software, and tested backup give owners a practical way to reduce risk and restore service when needed.

Sources

• A Security Flaw Is Affecting Millions of Websites
• CISA Urges Organizations to Immediately Patch Vulnerabilities Found in Many Websites
• Secure Your Business
• specification.website
• legacy.sba.gov
• cisa.gov

Want a second pair of eyes on this for your own site? Start with a message: send us your site address and your question. If talking it through will help, book the free 60-minute phone or Zoom consultation, which covers a look at your current website and online presence, your goals, and a written action plan with next steps sent afterward.