The October PHP security update, and what we did about it
Two critical flaws were found in PHP, the language most websites run on. Here's what happened, and how we protected every website we host.
On 21 October 2026, the team behind PHP released an urgent security update. PHP is the language that runs WordPress and most of the web, so this one mattered to almost every website owner.
What happened
The update fixed two serious flaws, rated 9.2 out of 10 for severity. In the wrong hands, they could let an attacker run their own code on a web server just by sending it a specially crafted request, with no password needed. Security researchers showed it working against WordPress, Drupal and Joomla sites.
The flaws go back many years, so every version of PHP still in use was affected until patched. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What we did
We updated PHP on our servers to the fixed versions on 21 October, the same day the fix was released. Every website we host now runs a patched version.
We checked every site after the update to make sure pages, logins and forms still worked.
Our web application firewall sits in front of every site and filters out suspicious requests before they reach your website.
Each client's websites are kept in their own separate space, so a problem on one account can't spill over to another.
Our security watch checks every site every hour for signs of tampering, such as unexpected files or new admin accounts, and alerts our team straight away.
Do you need to do anything?
If we host your website, no. The fix is already in place.
If your website is hosted somewhere else, ask your host whether they've applied the 21 October PHP security release. If they can't give you a clear yes, it's worth acting quickly.
The bigger picture
Updates like this are a normal part of running a website. What matters is how quickly they're applied, and whether someone is watching. That's the job we do for you, so you can focus on running your organisation.
Not sure your website is protected? Free digital growth check and get a quick overview of where you stand. Want the full picture? Our detailed website audit covers security, speed and updates, with clear next steps.