If your website was slow, briefly unavailable or in maintenance mode on Wednesday, it probably had nothing to do with anything you did. A php security vulnerability was disclosed on 21 October 2026, and sites across the world were patched, restarted or taken down briefly while the fixes went in. Some high profile sites, Australian government ones among them, were reported offline during the clean up.
Most business owners have never thought about PHP, and there is no reason they should have. What this week exposed is a different question, and a fair one to ask of any supplier. Who is responsible for keeping your website patched, and how quickly do they move when something like this lands?
Key Insight:
A website rarely fails because of one dramatic attack. It fails because nobody was responsible for updating it when the warning came.
What Actually Happened on 21 October
The PHP project released emergency updates fixing two flaws, both rated 9.2 out of 10 on the industry severity scale. Both allow what is called unauthenticated remote code execution. In plain terms, an attacker could get a server to run their code without logging in and without any involvement from the site’s owner.
The two issues are catalogued as CVE-2026-109618 and CVE-2026-109619. Fixed versions were published as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
One detail matters more than the numbers. The worst case runs on Apache with mod_php, where the flaw can be triggered before any of your website’s own code loads. Your security plugin, your firewall rules and your login protection all live inside WordPress, and WordPress had not started yet.
The PHP security team gave a day’s public notice before releasing the patches, which hosting providers need in order to prepare. It also tells anyone paying attention that a critical fix is coming, which is why the hours just after a release like this are the ones that count.
Why a Flaw in PHP Reaches So Many Business Websites
PHP is the programming language a very large share of the web is built on, including WordPress. Your site does not use PHP as a feature. It is what your site is made of.
That makes a flaw at this level different from the security problems most business owners have heard about. When a plugin has a vulnerability, the sites running that plugin are exposed and everyone else carries on. When the flaw is in PHP, the plugin you chose and the theme you paid for are beside the point, because both are sitting on the same foundation.
It is also why “we have a security plugin” was not an answer this week. Plugins defend the application, and this sat a floor below the application. Our broader guide to what every business should know about WordPress security covers where plugin level protection does and does not help.
Why Some Sites Went Offline and Others Stayed Up
Patching PHP is not always a quiet job. Moving to a fixed version can mean a version bump, and version bumps break things. An old plugin stops working, or a custom function written in 2019 starts throwing errors.
So the sites that went down on Wednesday fell into two groups. Some were taken offline deliberately, which is a fair call when you need to patch fast and cannot test first. Others went down because the update broke something nobody had checked, then stayed down while someone worked out what.
The sites that stayed up had something unglamorous in common. Somebody already knew which PHP version each one ran, had a recent backup, tested the update somewhere safe first and watched the site afterwards. None of that is clever. It is just arranged in advance.
This is what our website support clients were paying for. Their sites were patched, checked and monitored, they were not affected, and they stayed up. We emailed them the same day, so the first they heard of it was from us rather than from the news. Most of them did not have to do anything at all.
What Good Website Support Does When a Vulnerability Lands
The work itself is not mysterious. It is a sequence, and it either happens or it does not.
- Apply the security patches, prioritising the most exposed configurations.
- Update PHP to the latest version the site can actually run.
- Run compatibility checks so plugins, themes and custom code still work.
- Monitor each site afterwards, because problems often show up on the second day, not the first.
- Tell the client what happened, what was done and whether they need to act.
That last one gets skipped more than any of the others, and it is the one business owners notice. Being told your website was fine is worth something. Finding out six weeks later that it was never patched is worth considerably less.
How Do You Tell If Your Website Is Properly Supported?
Ask. You do not need technical knowledge to judge the answers, only to notice how long they take and whether they arrive as answers or as questions.
- Which PHP version is my website running right now?
- Who updates it, and on what schedule?
- Do you test updates somewhere before applying them to the live site?
- Will I hear from you when something like this happens, or do I find out from the news?
- If an update breaks something, what is the rollback plan?
One answer deserves particular attention. PHP 8.1 and anything older no longer receives security updates from the PHP project, and 8.2 stops being supported on 31 December 2026. If your site sits on 8.1 or below, this week’s patches were never going to reach it, and the real problem is the next one.
Our website maintenance packages exist to make these answers boring, which is the correct outcome.
Website Security Is a Business Risk, Not a Technical Task
It is easy to file this under IT and move on. The costs do not land in IT.
A website that is down is not taking enquiries. For a service business, an afternoon offline in a busy week is a number of calls that went somewhere else, and nobody reports those because nobody sees them. We have written before about what happens when your website goes down and your leads stop.
A compromised site is worse than an offline one. Search engines flag it, browsers put a warning in front of it, and that warning stays attached for as long as the clean up takes. If the site holds customer details, you also have a notification obligation.
None of that is a technical problem. It is revenue, reputation and time, and it is decided by a maintenance arrangement somebody either has or does not.
Key Takeaways
- The flaw sat in PHP itself, so many unrelated websites were exposed at the same time, regardless of their plugins or theme.
- Most business owners do not know what their site runs on, which is exactly why the support arrangement matters.
- Patching can break things, so testing and monitoring are what separate a planned maintenance window from an outage.
- If your site runs PHP 8.1 or older it is already outside the project’s support, and 8.2 ends on 31 December 2026.
- Ask your provider how they handled this one and when you first heard from them. The timing tells you most of what you need.
FAQs
Q: What is PHP, and does my website use it?
PHP is a programming language used to build websites and the systems behind them. If your site runs on WordPress, it uses PHP, as do many other content management systems. You never see it from the front of the site, which is why it goes unconsidered until a week like this one.
Q: Do I need to do anything if my website is professionally supported?
Usually not, though you are entitled to confirmation rather than silence. A supported site should have been patched without you being involved, and you should have been told it happened. If you have heard nothing from whoever looks after your site, ask this week rather than next quarter.
Q: How often should a business website be updated and monitored?
Core, plugin and theme updates suit a monthly cycle for most business sites, with security patches applied on release rather than held for the next scheduled run. Monitoring should be continuous, because its whole purpose is catching what happens between visits.
Knowing Who Patches Your Website
The uncomfortable part of a week like this is not the vulnerability. Flaws get found in every language and every platform, and they will keep being found, which is why the fix arrives with a version number rather than a promise that it will not happen again. What separates the businesses that had a quiet Wednesday from the ones that lost a day is not better software or a bigger budget. It is whether somebody had already decided that keeping the site patched was their job.
XDesigns Advertising provides ongoing website support and maintenance for Australian businesses, which covers patching, PHP version updates, compatibility testing, monitoring and telling you what happened before you read about it somewhere else. Send one message to whoever currently looks after your website and ask which PHP version it is running today. If the answer takes more than a day, or comes back as a question, send us your website address and we will check it for you.
