Critical security vulnerabilities affecting PHP have put website security firmly in the spotlight. The UK's National Cyber Security Centre (NCSC) has urged organisations to act immediately, as the flaws could allow attackers to run malicious code on vulnerable web servers.

For businesses, it's an important reminder that website security isn't something you address once at launch and forget about. The technology behind your website needs to be maintained, updated and supported throughout its lifetime.

What has happened?

PHP is a programming language used to run a large share of the world's websites, including every WordPress site. It works behind the scenes, helping websites deliver content, process information and interact with databases.

On 21 October 2026, the PHP development team released emergency security updates for two critical vulnerabilities, nicknamed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). The flaws affect PHP installations that serve web pages and could allow an attacker to run their own code on a server with a single request, without needing to log in. Exploitation attempts were reported before the fixes were even published.

The NCSC has advised organisations to identify any systems running PHP, apply the updates immediately and consider taking offline any system that can't be patched straight away. You can read the NCSC's guidance here.

PHP itself isn't inherently insecure. Security fixes are a normal part of maintaining any software. What matters is whether those fixes can be, and are, applied quickly. Websites on supported versions of PHP could be patched as soon as the updates were released. Websites on older, unsupported versions (PHP 8.1 and earlier) no longer receive official updates at all.

Why does this matter to your business?

Your website is likely to be one of your most important business assets. It showcases your services, attracts new customers, generates enquiries and builds trust in your brand. If the technology behind it is outdated or unpatched, the consequences can extend well beyond the website itself.

Security risks can include:

  • Website disruption: A compromised or unavailable website can interrupt your marketing activity and stop customers from contacting you.
  • Data security concerns: Depending on how your website and server are set up, a successful attack could expose sensitive information or provide access to other systems.
  • Damage to your reputation: Customers expect businesses to take the protection of their information seriously.
  • Unexpected costs: Recovering a compromised website, investigating an incident and restoring normal operations can be expensive.
  • Lost enquiries and sales: If your website is offline or no longer trusted, you could miss out on valuable business.

What should you do now?

  • Ask your developer or hosting provider which version of PHP your website uses, and whether the October 2026 security update has been applied.
  • If your website runs on PHP 8.1 or earlier, plan an upgrade. Official security fixes are no longer provided for these versions.
  • Check that your content management system, plugins and themes are up to date. If your site is built on WordPress, it runs on PHP.
  • If you don't know who is responsible for maintaining your website, make finding out your first priority.

The challenge with older websites

Many businesses still run websites built years ago on legacy content management systems, older PHP versions or platforms that are no longer actively supported. Over time, these sites become harder to maintain. Software dependencies fall out of date, compatibility issues arise and security updates may no longer be available.

Hosting providers can often add protective measures, but these aren't a permanent fix if the software underneath can't be updated. A website might still look perfectly fine to visitors while the technology behind it becomes increasingly difficult to keep secure.

Why a supported, well-maintained website matters

The PHP2Shell vulnerabilities affected up-to-date websites too. The difference was that websites on supported, actively maintained platforms could be patched quickly. The key isn't simply choosing the newest technology; it's making sure your platform is supported, properly looked after and right for your business.

Our approach at b4b is to treat security, performance and ongoing maintenance as part of the overall website solution, not an afterthought. That includes:

  1. Supported technology: Using platforms and software versions that receive regular security updates reduces your exposure to known vulnerabilities.
  2. Ongoing maintenance: Websites need regular attention. Software updates, compatibility checks and security monitoring help catch issues early and keep your site running as it should.
  3. Secure hosting and server management: Security also depends on the hosting environment, server configuration and access controls, which need to be managed alongside the website itself.
  4. Performance and reliability: A well-maintained website delivers a better experience for visitors, with faster load times and greater reliability supporting your wider marketing goals.
  5. Room to grow: Your website should evolve as your business does, allowing you to add new services and functionality without being held back by legacy technology.

No website can be guaranteed 100% secure. However, a properly supported and maintained website puts you in a far stronger position to manage risk, and to respond quickly when issues like this arise.

Is your website still fit for purpose?

If your website was built more than five years ago, it's worth finding out which platform and software versions it uses, whether they're still supported and who is responsible for applying security updates.

Warning signs include:

  • Your website runs on an outdated content management system.
  • Your website runs on PHP 8.1 or earlier, which no longer receives official security updates.
  • Your website developer can no longer provide updates or technical support.
  • You're unsure whether your website is being maintained.
  • Making changes or adding new features has become increasingly difficult.

If any of these sound familiar, it may be time to review your website and decide whether ongoing support, an upgrade or a full rebuild is the most sensible long-term option.

Keep your website secure with b4b

The PHP2Shell vulnerabilities are a timely reminder that keeping your website up to date is essential. Your website should support your business ambitions, with the confidence that its technology is being properly looked after.

Our website support and web hosting services keep your site updated, monitored and secure. If your current website is built on legacy technology, our web design team can create a modern website that gives your business a strong foundation, with opportunities to improve performance, search visibility and lead generation.

Concerned that your website may be running on outdated technology? Contact the b4b team to discuss your current website, understand your options and plan your next steps.