The PHP vulnerability affecting most of the web — and what it means for you
Two critical vulnerabilities in PHP are being actively exploited. Roughly 70% of the world's websites run PHP, so this is not an obscure developer problem — it is the machinery behind the sites, shops and portals people use every day.
What actually happened
PHP is the programming language that powers a large share of the internet, including a lot of UK business websites, online shops and booking systems. Two flaws were found that let an attacker run their own code on a server — the most serious category of vulnerability there is.
Developers have released fixes. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older, including all of PHP 8.1, no longer receives fixes.
Are you at risk?
If you are an ordinary member of the public: there is nothing for you to install. The risk is to the websites themselves, not to your phone or laptop.
If you run a website or a small business with one: this is yours to deal with, and it is urgent. Ask your developer or hosting provider directly whether your PHP version has been updated, and confirm they restarted the web server afterwards — an update without a restart leaves the old code running.
What you should do
- Find out what version you run. If you have hosting, your control panel or provider will show it. If you have a developer, ask them.
- Take a backup before anything changes. A snapshot now costs minutes; recovering without one costs days.
- Update to a patched version. PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Use your package manager or control panel — do not download binaries from an email or a random site.
- Restart the web server. Old processes keep serving old code until they are restarted.
- Verify. Confirm the running version, not just the installed one.
A warning about the warnings
Whenever a story like this breaks, scammers send emails claiming to be from hosting providers, telling you to install an urgent patch. We have seen these already this week.
Never install software from a link in an email. Never reply to one. Go to your provider's own website, log in as you normally would, and check there. If a security update is genuine, it will be waiting for you in the place you already trust.
Sources
Krebs on Security, "Widespread PHP Flaw May Cause Many Site Outages Today" (21 October 2026) · Official PHP release changelogs · Reviewed by the CyberAware UK news desk. This page is background, not legal or technical advice for your specific systems.