Attacks Are Getting Faster: What This Week's PHP Flaw Teaches Small Businesses

What you will need: About 10 minutes to read, and a list of the websites, computers, and online accounts your business relies on.

On October 21, 2026, the team behind PHP released an urgent security fix. PHP is the software that powers a large share of the web, including most WordPress sites, so if your business has a website, there's a good chance PHP runs somewhere underneath it.

This guide explains what happened in plain English, why it matters even if you've never heard of PHP, and the habits that protect a small business when the next one hits. There will be a next one.

What happened

PHP's developers fixed two serious flaws that could let an attacker take control of a web server by sending it a single request, without logging in. Security experts ranked them among the most severe problems ever found in PHP.

The warnings were unusually strong. CERT-EU, the cybersecurity team for EU institutions, and the UK's National Cyber Security Centre advised organizations to consider taking websites offline if they couldn't install the fix right away. Some government websites did exactly that.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older versions (8.1 and earlier) no longer get official fixes at all.

Why this one is a warning sign

The flaw itself isn't the main lesson. The speed is.

A working attack was demonstrated within a day of the fix going public. Researchers at the security firm Wiz said AI tools had substantially lowered the barrier to turning flaws like these into working attacks. Work that once took a skilled attacker days or weeks can now go much faster.

For years, small businesses could get away with updating "when we get to it." Attackers mostly went after big targets, and there was usually a gap between a fix being published and criminals using the flaw. That gap is shrinking. When a fix is published, attackers can study what changed and work backward to the weakness, and AI makes that faster.

What that means for you: updates aren't a chore to put off anymore. They're one of the main things standing between your business and an attack.

Lesson 1: Someone has to be responsible

The most common reason a business gets hit isn't a lack of tools. It's that nobody was watching. The website was "set up by a guy years ago," the computers update "probably," and nobody knows who would hear about an urgent fix.

Make it someone's job, even if it's a small one:

1. List what you depend on. Your website, your computers, your network equipment (router, Wi-Fi), and the online accounts you can't work without.
2. Write down who looks after each one. It might be you, an employee, your web host, your web designer, or an IT provider.
3. Ask each of them one question: "When an urgent security fix comes out, how fast do you install it, and how will I know?"

If the answer to any of these is "nobody" or "I'm not sure," that's the gap to close first. If you'd rather hand that job to someone, keeping systems updated is part of what we do. Get in touch and we can talk through what you have.

Lesson 2: Know what you're running, and retire what you don't use

You can't update something you've forgotten exists. Old websites, test pages, a contact form from years ago, an old laptop in a drawer that still syncs to your email: forgotten systems are easy targets because nobody patches them.

Here's how we responded on our own systems the day the fix and the agency warnings came out. It's a good model for any small business:

1. Installed the fix within hours and confirmed every copy of PHP was on a fixed version.
2. Turned PHP off everywhere it wasn't needed. Software that isn't running can't be attacked.
3. Closed admin and control panels to the public internet, so they're only reachable through a secure connection.
4. Retired old sites we no longer used, keeping a backup in case we ever want them again.

Most of that took an afternoon. You can do the same review on your own setup, or ask whoever manages it to walk you through it:

1. Ask your web host for a list of every website and add-on on your account.
2. Take down anything you don't use. Keep a backup first if you might want it later.
3. For what stays, confirm it's getting updates.

Lesson 3: Keep everything updated, on a schedule

Turn on automatic updates wherever you safely can, and set a monthly reminder to check the rest. These guides walk you through it:

• How to Check for Windows Updates
• How to Keep Your Business Software Up to Date Without Breaking Anything
• Is Your Computer Too Old? Signs It's Time to Replace It, for machines that no longer get security updates

Lesson 4: Assume something will get through, and limit the damage

Updates close the doors you know about. These habits protect you when something slips past anyway:

• Two-step sign-in everywhere it's offered. A stolen password alone stops being enough. See How to Turn On Two-Factor Authentication for Microsoft 365.
• Unique passwords, stored in a password manager. See Password Managers for Small Teams.
• Backups you've actually tested. If the worst happens, you restore instead of starting over. See Backing Up Your Business Files: The 3-2-1 Rule.
• A team that can spot a fake message. See How to Spot a Phishing Email.

For a quick self-check across the basics, see Five Common Security Risks at a Small Business.

What to do this week

1. If you have a website, ask your web host or designer: "Has PHP on my site been updated to the October 21 security release?"
2. Name who is responsible for updates on your website, computers, and network.
3. Take down one thing you don't use anymore.
4. Turn on two-step sign-in for your email if it isn't on already.

Technology keeps moving, and attackers are moving with it. You don't need to become an expert. You need someone paying attention, and a few habits that hold up when the next urgent fix lands. If you're not sure where to start, send us a note. No stupid questions.