In short: Two critical security flaws have been found in PHP, the code behind around 70% of websites, including WordPress, Magento, Joomla and Drupal sites. The UK’s National Cyber Security Centre (NCSC) advises updating to the fixed version of PHP now, with temporary fixes or taking the site offline as fallbacks if that can’t happen straight away. Your web developer or hosting company can tell you today whether your site has been updated.
If your business has a website, there’s a good chance this week’s global security warning applies to you. Attackers started using the flaws within hours of them being announced, so it’s one to deal with this week. Here’s what’s happened and what to do about it, without the jargon.
What is the PHP security warning?
PHP is a programming language that runs on the server behind a website. This week, the PHP developers released urgent updates to fix two critical vulnerabilities that, under certain conditions, could let an attacker take control of the server a website runs on. The US National Security Agency warned the flaws could give attackers “a direct path to the server’s file system or database”, which is where things like customer details and enquiry data are stored.
The response from attackers was fast. Cloudflare, which handles traffic for a large share of the internet, reported tens of thousands of exploitation attempts in the 45 minutes after the announcement and millions soon after. Several UK organisations, including Oxford City Council, the City of Edinburgh Council and the Office for Budget Responsibility, took their websites offline as a precaution.
Does it affect my website?
If your website is built on WordPress, Magento or a similar platform, it almost certainly runs on PHP. The NCSC says every version of PHP is affected, so a recent version doesn’t mean you’re safe. What matters is whether this week’s fix has been applied. Your web developer or hosting company can confirm both points quickly. If your site is on a hosted website builder such as Wix, Squarespace or Shopify, the platform manages the servers, so there’s nothing for you to update.
Why does it need looking at now?
Security warnings come out all the time and most don’t need a business owner’s attention. This one does, for two reasons. The first is scale, as PHP sits behind so many websites that attackers can scan the internet automatically for any site that hasn’t been updated. The second is speed, as the flaws are already being used and the gap between a fix being released and a site being attacked is now measured in hours.
The NCSC’s advice, published on 21 October 2026, is to update to the fixed version of PHP now. If that can’t happen straight away, the PHP developers have published temporary fixes. If those aren’t possible either, the NCSC recommends taking the site offline. Any site that stays online without the fix should be checked for signs of a break-in.
Why it’s easy to assume this isn’t your problem
It’s natural to read the headlines and assume this is a problem for big organisations. These attacks are automated, though, and a small business website gets scanned just as readily as a council’s. Smaller sites can be an easier target, as they’re less likely to have someone checking them regularly.
Plenty of people also assume their hosting company takes care of updates. Some do, especially on managed WordPress hosting, while others leave it to the website owner. Even where the server has been updated, out-of-date plugins and themes can leave gaps of their own.
There’s also the assumption that if the site looks fine, it is fine. Most attacks are designed to go unnoticed, so a site that looks normal on the surface isn’t a reliable sign that everything’s in order.
What should I do, and when?
You don’t need to understand how the flaw works to deal with it. What matters is that the right person checks your site soon.
- Today: ask your web developer or hosting company whether your site runs on PHP and whether it’s been updated to the fixed version. Attacks started before the fix was released, so ask them to check the site for signs it was accessed as well. If it can’t be updated straight away, they should follow the NCSC’s advice on temporary fixes, and consider taking the site offline until it’s done.
- Over the coming weeks: check your plugins and themes are up to date and that you have a recent backup you know can be restored. Then put regular maintenance in place, so updates happen as a matter of routine and the next warning doesn’t catch you out.
What if my website needs to come offline?
Taking a website down, even for a few hours, will raise questions from customers. A short, calm message on your social channels or by email explaining that you’re carrying out a security update goes a long way. It shows you’re on top of things and stops people assuming the worst.
How Clear Cut can help
At Clear Cut, our web and tech specialists can check whether your website is affected, look for signs of compromise and either handle the update or work with your hosting company to get it done. As we also work across PR and communications, we can help you decide what to say to customers if your site has to come offline. Having the technical fix and the message handled by one team saves you time when you’ve already got plenty on.
If you’ve got any concerns about your website, book a free call with our team. We’ll talk you through where you stand and what, if anything, needs doing next.
Frequently asked questions
What is PHP?
PHP is a programming language that runs on the server behind a website. It powers platforms such as WordPress and Magento and is used by around 70% of websites, according to Cloudflare.
How do I know if my website uses PHP?
If your site is built on WordPress, Magento, Joomla or Drupal, it uses PHP. Your web developer or hosting company can confirm it and tell you which version you’re running.
What does the NCSC advise?
The NCSC advises updating to the fixed version of PHP now. If that can’t happen straight away, the PHP developers have published temporary fixes. If those aren’t possible either, the NCSC recommends taking the site offline. Any site that stays online without the fix should be checked for signs of a break-in.
Is a small business website really at risk?
Yes. The attacks are automated and scan the internet for any site that hasn’t been updated, whatever its size.
Is my site safe once it’s updated?
No, not automatically. Attacks started before the fix was public, so an updated site may already have been accessed. Ask whoever updates it to check for signs of compromise.
Does my hosting company update PHP for me?
Some do, particularly on managed WordPress hosting, while others leave it to the site owner. It’s worth asking your host to confirm.
