If your business has a website, an online booking system or a web app built by an agency, there is a good chance it runs on PHP.
Today the PHP project will release emergency security fixes for two critical flaws, and a leak means attackers may already be reading the same clues you are.
The good news: you have a few hours to prepare, and most of the preparation is just knowing what you run.
What happened
On 20 October the PHP security team gave advance notice of an upcoming security release. In its words, it is scheduled for Wednesday 21 October 2026 at 14:00 UTC and addresses two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale. Read PHP's notice. The team reserved the right to release earlier if details become public or exploitation appears.
Details leaked on 20 October, before the fixes were ready. Security firms Huntress and watchTowr have said the flaws are real, and researchers are calling the pair "php2shell".
Public reporting describes them as remote code execution flaws, which means an attacker could run commands on a vulnerable server. The CVE numbers circulating (CVE-2026-109618 and CVE-2026-109619) come from the leak and researchers rather than from PHP's own notice. The Hacker News and Huntress both have write-ups.
What we know, and what we don't
As of this morning, Huntress had not seen exploitation in its partner environments, and watchTowr reported none either. PHP has not yet said which versions are affected or which versions contain the fix. Reports that every version since PHP 5 is affected are unconfirmed. Some researchers expect fixes only for currently supported branches, which would leave older, end-of-life PHP versions without an official patch. That is a prediction, not a confirmed fact, so check PHP's release notes this afternoon.
The reach could be wide. Security firm Mallory counted about 884,000 internet-facing hosts whose banner reported PHP 8.1 or older on 20 October, around 59% of the roughly 1.5 million hosts reporting a version. Those are banner counts, not confirmed vulnerable systems, but they show how many sites sit on older PHP.
What this means for UK small businesses
Most small firms don't run PHP knowingly. It sits underneath WordPress and many other website tools, hosting control panels and add-ons, and it can be bundled inside software from suppliers.
That makes this a classic shared-responsibility problem: your web agency, your host or your IT provider probably holds the keys, but it's your customer data and your reputation on the line.
The biggest risk is the old site nobody owns: the brochure site from 2017, the microsite for a past campaign, the booking tool that "just works". If it runs on end-of-life PHP, there may be no official fix to install. For IT providers and MSPs, it is a good moment to check every client site you host or support.
What to do this week
List what you run. Write down every website, web app and customer portal, who built it, who hosts it and which PHP version it uses. Include PHP bundled in supplier software and control panels such as cPanel or Plesk.
Ask your host and agency today. Send one short email: "Are you patching PHP after today's release, and when?" Get a time in writing. Managed hosts often apply fixes for you, but confirm it.
Patch the public-facing sites first. Once the fixed versions are published, update anything reachable from the internet before internal systems, and check whether your Linux distribution or host has backported the fix.
Deal with end-of-life PHP. If a site runs on a version that no longer receives fixes, upgrade it, take it offline, or put it behind a VPN or web application firewall. Retire sites you no longer need.
Watch for odd behaviour. Huntress expects exploitation to show up as PHP processes launching shells or download tools. If you suspect a compromise, isolate the server, keep the logs, and look for unfamiliar files in the website folders, new scheduled tasks and new user accounts.
Sophia Says
Leaks like this are awkward because the clock starts for defenders and attackers at the same moment. I wouldn't panic, but I wouldn't wait for the weekend either. The firms that cope best are the ones who already know which sites they have and who looks after them.
That's where HackRisk helps: we show you what your business exposes to the internet and flag known weaknesses on those systems, so the question "which of our sites need attention?" has an answer before the next big advisory lands.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Unknown websites: the Recon Scan shows what your business exposes to the internet, which helps you spot forgotten sites and services.
Known weaknesses: the Vulnerability Scan checks internet-facing systems for known vulnerabilities, so you can see where updates are needed once these flaws are formally catalogued.
Suppliers: our Supply Chain Risk service helps you keep an eye on the third parties who build and host your systems.
Get your free HackRisk report
Want to know what your business looks like from the outside before the next advisory? Get your free HackRisk report.