Free consultation

Insights

Security alert. A must read if your website runs on WordPress, WooCommerce or Joomla.

Is your business website on WordPress? Read this today.

On 21 October 2026 the UK's National Cyber Security Centre warned about two critical flaws in PHP, the code that runs WordPress and most websites. If your site is self-hosted on WordPress, WooCommerce or Joomla, give this ten minutes today.

By Leadaline4 minute read

The alert in 45 seconds. Voiced with AI.
Read the video's words

Does your business website run on WordPress? This matters today. Two critical flaws were found in PHP, the code underneath it. The UK's cyber security centre says attackers could run commands on any web server running PHP. PHP runs about seven in ten websites, and about one in three of those run a version that won't get the fix. For a business, that means a site that can be taken over, lost enquiries, and customer data at risk. So today, ask whoever runs your website to update PHP. Or let us check it for you, free. We'll rebuild it on modern, fast code that doesn't run on PHP, and make every change for you. Book a free consultation, and get a free search report too.

What happened

The two flaws are known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The NCSC says attackers could use them to run commands on any web server running PHP, and its alert of 21 October is blunt about the scope: "Organisations using any version of PHP are affected."

The PHP team released fixed versions the same day: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Only PHP 8.2 to 8.5 are still supported, so those are the only versions getting a fix.

This isn't theoretical. Details leaked before the fix was out, the security firm watchTowr reports the flaws being used in attacks, and New Zealand's NCSC says it is aware of reports of active exploitation. In Europe, some government, hospital and university websites were taken offline after advice from CERT-EU.

Who it affects

PHP runs 69.2% of websites whose server code W3Techs can identify, and 34.5% of those run PHP 7 or PHP 5, which no longer get fixes. W3Techs, 25 October 2026.

The sites at risk are the ones that run their own PHP: self-hosted WordPress, WooCommerce, Joomla and similar. WordPress alone runs 39.6% of all websites, according to W3Techs.

If your site is built on Wix or Squarespace, the platform patches it for you, and there is no confirmed breach of either.

For a business, the risk is a website that can be taken over, enquiries that never arrive, and customer details in the wrong hands. It's a common gap. The government's latest survey found 43% of UK businesses had a cyber breach or attack in the past year, and only 25% have a formal plan for what to do when one happens.

What to do today

  1. Ask whoever runs your website which version of PHP it's on. That might be a web developer, an agency or your hosting company. If nobody's sure who runs it, that's worth knowing too, and it's more common than you'd think.
  2. If it's PHP 8.2 or newer, ask them to update today to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The NCSC says to do internet-facing systems first.
  3. If it's older than 8.2, no fix is coming. That includes PHP 8.1, 8.0, 7 and 5. The site needs moving to a supported version, or rebuilding.
  4. Ask them to check for backdoors. The NCSC advises it, because the details were out before the fix.

How we can help

We'll check your website for free and tell you plainly what it runs on and what needs doing. If it's time for a new one, we rebuild it on modern, fast code that doesn't run on PHP, bring your content across and make every change for you. Requests any time, a response within 48 hours.

Book a free consultation and you'll also get your free Google, AI and agent search report: what your current site isn't doing well, and how we'd fix it. We go through it together on the call.

See how we build websites

Sources