Critical PHP flaws: what small businesses should do now

This story is developing and details may change. Last checked 25 Oct 2026.

What happened

Reported by Critical security issue affecting PHP (NCSC advisory) on 20 Oct 2026. The event itself dates from 21 Oct 2026.

The PHP project released patches for critical remote code execution flaws. The UK National Cyber Security Centre issued guidance urging urgent mitigation and patching (claim 1). Security vendors and reporting observed proof‑of‑concept code and exploitation attempts circulating; some vendors reported active attempts though broad confirmed compromises were not publicly reported at the time (claim 2). After disclosure, traffic scanning and exploit attempts grew quickly, with reports of thousands initially and then many more within hours (claim 3). AWS threat intelligence reported seeing attempts, including on honeypots, before public disclosure and advised organisations to check for suspicious activity dating back before the public notice (claim 4). WordPress and other stakeholders urged immediate updates and suggested taking exposed systems 1 3 2 4

Why it matters to small businesses

These vulnerabilities affect the PHP runtime itself, so any site or service that runs PHP to serve web requests could be at risk. Because the issue sits in the runtime rather than a single plugin or theme, many different websites and applications could be exposed. After patches were published, attackers widely scanned for and attempted exploitation, increasing the likelihood that unpatched systems could be reached. The NCSC and WordPress.org have therefore advised urgent action; vendors and cloud threat teams recommend investigating prior suspicious activity because some scanning and attempts were observed before public disclosure. For small businesses this means your web hosting, content management system and any custom PHP software need checking and likely updating without delay. 1 3 2 4

TabSphere's view

This section is TabSphere's interpretation, not reported fact.

Interpretation: If your site or shop runs PHP, treat this as high priority. The risk is not limited to specific plugins or themes because the runtime is affected. Promptly applying the official PHP patches or following your platform provider's update advice is the simplest, most reliable way to reduce risk. If you cannot update straight away, consider taking any directly exposed PHP service offline or restricting access until patched. Also check logs or ask your host whether they saw any suspicious activity before the fixes were published.

What to do next

• Identify if you run PHP. Check with your hosting control panel, your developer or your platform provider to confirm whether your website or web application runs PHP and which major PHP version is in use. If you are unsure, ask your host for confirmation.
• Apply official patches or update platform. Follow the official PHP updates or your platform's guidance and install the patches recommended by PHP and ecosystem maintainers. If you use managed WordPress hosting or a CMS provider, apply their updates as advised.
• Take exposed systems offline if you cannot patch. Where immediate updating is infeasible, consider temporarily taking directly exposed PHP services offline or restricting external access until the environment can be patched, as urged by major ecosystem stakeholders.
• Review logs and investigate prior activity. Ask your host or cloud provider to check logs for suspicious activity and follow their advice. Industry reporting noted exploit attempts before public disclosure, so investigate any anomalous accesses that predate the patches.
• Limit exposure and follow provider advice. Reduce unnecessary public-facing PHP interfaces where possible and apply recommended mitigations from your hosting or platform provider. Keep plugins and themes updated as part of the update process.

Sensible precautions

• Do not rush to apply third‑party fixes from unknown sources; use official updates from PHP or your platform provider.
• If you use a hosted platform, coordinate with the host rather than making unverified changes yourself.
• Keep backups before making major updates so you can restore if an update causes issues.

What isn't known yet

• Reports mention active exploitation attempts and mass scanning, but publicly confirmed widescale successful compromises were not reported in the available brief.
• Details about which specific hosting setups were most affected beyond general statements in the brief are not provided.

If your website, shop or web tool uses PHP, take a calm, organised approach: confirm whether PHP is used, apply the official updates or follow your provider's guidance, and investigate any unusual activity. These steps will materially reduce exposure without overreacting.

If you want a clear assessment of your site, software or design and how updates should be applied, get in touch and we can talk it through.

Sources

Checked 25 Oct 2026.

• Critical security issue affecting PHP (NCSC advisory) (published 20 Oct 2026)
• Tech Reacts to PHP Vulnerability Exploits (Digit.fyi) (published 23 Oct 2026)
• Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure (The Register) (published 22 Oct 2026)
• Critical PHP Security Release (WordPress.org) (published 21 Oct 2026)