The PHP Flaw That Shut Websites Down: Is Yours at Risk?

On Wednesday 21 October 2026 the team that maintains PHP published emergency security fixes, and within two days websites around the world had been switched off to apply them. The UK government was among those pulling services offline as a precaution.

If your site runs on WordPress, WooCommerce or most other popular website systems, you may be wondering whether this is your problem. It may well be. The awkward part is that the answer does not sit in your admin dashboard. It sits with whoever runs your web server.

Here is what happened, what to ask your hosting company this week, and the change that means you never have to worry about this kind of bug again.

What happened on 21 October

PHP is the language that sits behind the scenes of most websites. Cyber-security firm Wiz, which helped uncover the flaws, told the BBC that PHP runs around 70% of the world's websites. When something breaks in PHP, it breaks for a lot of people at once.

On 21 October the PHP project released emergency updates (versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35) fixing two flaws the PHP security team rated 9.2 out of 10. Both can be triggered by a request that arrives with no login, no password and no account. Under the right conditions, whoever sent that request can get their own code running on your server.

The UK's National Cyber Security Centre published its alert the same day. Its priority actions were straightforward: find every system running PHP, update them, apply the temporary protections if you cannot update yet, and consider taking the system offline if you can do neither.

Why this is not a WordPress update

WordPress.org posted a notice titled "Critical PHP Security Release" on 21 October, and it is worth reading twice. The flaws are not specific to WordPress. No WordPress update is required or planned. The fix belongs to the server your site sits on, which means it belongs to your hosting company. Inside WordPress you can see which version of PHP you are running under Tools, then Site Health, then Info, then Server.

This is also why installing a security plugin will not close this particular hole. A plugin is PHP code that runs on top of the engine, so it can block some attacks and flag suspicious behaviour, but it cannot repair the engine underneath it. Keeping your plugins updated is still good practice. It just is not the answer to this one.

One more reason to know your version: WooCommerce said on 29 September 2026 that version 11.6, due February 2027, will require PHP 8.1 or newer. Leaving it to the deadline means changing a server under time pressure instead of during a quiet week.

What actually happened in the UK

The BBC reported on 22 October that websites worldwide were taken offline on the Wednesday and Thursday after the announcement. Answering the House of Lords, the tech minister said 32 UK government services were unavailable and four partly unavailable, largely as precautionary measures, and that no large public-facing UK critical services had been affected.

There was good news in there too. No successful attacks had been reported, and the NCSC's chief technology officer told the BBC there were "no indications" of successful breaches by hackers. The attempts, however, were immediate. Cloudflare's boss said his company saw thousands of attempts in the ten hours before the announcement, jumping to millions within two hours of it.

Not everything was dramatic. A garage in Chepstow found its system down from Wednesday morning and wrote MOT paperwork by hand for the rest of the week. No hack and no ransom, just a week of paper.

Five questions for your hosting company

You do not need any technical knowledge to ask these. You only need the answers.

1. Which version of PHP does my site run, and is it patched for the two flaws fixed on 21 October 2026? This is the one that matters most.

2. Do you have firewall rules in place to block exploitation attempts while servers are being updated? WordPress.org noted your host may already be doing this.

3. If a server cannot be updated immediately, which temporary protections have been applied? On 23 October the PHP project suggested switching off session upload progress until the next release, as a stopgap against an unlikely extra route into the same flaw.

4. When will any server still running PHP older than 8.2 be moved to a version that still receives security updates? The PHP project no longer issues fixes for versions before 8.2, so old servers only ever get lucky.

5. Will you confirm when my site is patched? A dated reply is worth keeping. If you are ever asked how you protected customer data, it is your evidence.

A decent host answers all five in one email, often within the hour this week. If the reply is vague or slow, that itself is the finding.

If your site cannot be updated straight away

The PHP project was blunt about the temporary measures: they reduce exposure to particular attack paths, but they do not make an installation safe. Only an update completes the job. Where even that is not possible, the NCSC's fallback is to consider taking the system offline until it can be properly fixed.

Neither option is attractive to a business that relies on its website for enquiries, which is exactly why question one above is worth asking before you need the answer.

The way to skip the next one

There is a simpler option. A site built as static pages has no PHP running at all, so a PHP emergency passes it by completely. For brochure sites, portfolios and lead-generation pages, that is worth considering, and we covered the trade-offs in moving from WordPress to a static AI-powered site. Whatever route you take, keep your backups tested and automatic, because patching and backups cover different disasters.

For sites that genuinely need a database, a shop or a booking system, the answer is hosting where somebody owns the patching. Our AI-powered hosting monitors for security releases and applies them, and our WordPress hosting is built around the version check, firewall and update routine described above, so the next 21 October is a notification you read, not a morning you spend chasing a server. Our web design team can take over the whole site, hosting included.

This article is general information about the PHP security releases of 21 October 2026 as they stand on 26 October 2026, not technical or legal advice. Check your own server or speak to your hosting provider about your situation.