Startup Blog for First Time Entrepreneurs who Bootstrap

PHP Vulnerability: Is Your Small Business Website Safe? A No-Developer Plan for Bootstrapping Founders

TL;DR: Does the PHP vulnerability affect my small business website?

If your website runs on WordPress, WooCommerce or another PHP system, yes, it depends on this fix. On 20 October 2026, the PHP team announced an emergency release for two critical vulnerabilities, each rated 9.2 out of 10. The fix came out on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. You don't need a developer to act: find out who hosts your site, check its PHP version, ask your host when they install the fix, and take a backup today.
Developing story. Last updated 22 Oct 2026, 14:25 CEST. Attack attempts are being reported, and no successful break-in has been confirmed so far. We will keep updating this article as PHP and the security agencies publish more.
Update 22 Oct, 14:25 CEST: here's the short version for website owners. Attackers are trying the flaws, and nobody has confirmed a successful break-in yet. Amazon says its decoy servers caught a first attempt on 17 October, before the news broke, and the Dutch National Cyber Security Centre (NCSC) said on 22 October that it has seen no successful attacks and that none of the public exploits it tested worked so far. The US agency CISA advises taking a site offline if it can't be updated. Many hosts have already installed the fix: Hostinger on all its hosting servers except VPS, GoDaddy on Managed WordPress and Windows hosting, and hosts that use cPanel or CloudLinux got patched PHP builds on 21 and 22 October. So the email to your host below takes two minutes and gets you a written answer. If your site runs on your own VPS, nobody patches it for you.
Update 21 Oct, 15:50 CEST: the fix is out. PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and its security advisory confirms that both flaws let an attacker run code on a server without logging in. Every PHP website is affected until its server gets one of these versions. PHP puts it plainly: "There are no complete mitigations, updating is the only safe choice." If your site runs PHP 8.1 or older, there is no official release for it: ask your host for a patched package and plan a move to PHP 8.3 or newer.
The PHP vulnerability announced this week is the kind of tech news most bootstrapping founders scroll past, and this time that would be a mistake. "PHP" jumped more than 300% on Google Trends in the US overnight, because the language behind most small business websites needs an emergency fix today.
I run several websites on a tiny budget, so here is the plain-language version: what happened, how to tell if your site is affected, and a 30-minute plan you can follow without writing a single line of code.

What happened with PHP on 20 and 21 October 2026?

PHP is the programming language that runs on the server behind a huge share of the web, including every WordPress site. On 20 October 2026, the PHP project posted an advance notice on php.net: a critical security release was coming on Wednesday 21 October at 14:00 UTC, to fix two vulnerabilities rated 9.2 on the CVSS scale (the standard 0 to 10 score for how dangerous a security flaw is).
Then the details started leaking. BleepingComputer reported that a Hacker News post broke the news early, and the security firm watchTowr confirmed it. PHP has since confirmed that both bugs allow remote code execution without logging in. In plain words: an attacker sends a request to your website and can end up running their own code on your server.
Date and timeWhat happened
17 Oct 2026Amazon’s decoy servers catch a first attack attempt, before the news is public
20 Oct 2026PHP announces a critical security release on php.net
20 Oct 2026Details leak online before the planned disclosure
21 Oct 2026, morningSome Dutch websites go offline as a precaution (per Sansec)
21 Oct 2026PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 with the fix
21 Oct 2026CISA tells organisations to patch at once, or take systems offline if they can’t
21 to 22 Oct 2026Big hosts roll out the fix: GoDaddy, Hostinger, cPanel and CloudLinux servers
22 Oct 2026, 13:00Dutch NCSC: no successful attacks seen, none of the tested public exploits worked yet
Here's the European angle. According to Sansec, several Dutch sites went offline on 21 October to wait for the fix, including the tech news site Tweakers, the Dutch House of Representatives and the national cyber security centre NCSC. Since then, Amazon, watchTowr and Cloudflare have reported attack attempts, while the Dutch NCSC said on 22 October that it had seen no successful attack. When security companies disagree, the safe move is to act early. By that evening Pokémon HOME, Wikimedia's tools and government sites in several European countries had switched off too, and MeanCEO explains why so many websites went offline over the PHP issue and how to decide for your own site.

How do I know if my website runs on PHP?

Ask yourself how your site was built. If the answer is WordPress, WooCommerce, Joomla, Drupal, Magento or PrestaShop, your site runs on PHP. W3Techs data from 21 October 2026 shows PHP behind 69.3% of the websites whose server language it can detect, so you're in big company.
If you built your site on a hosted website builder, you don't manage any server at all, and the platform takes care of its own updates. We compared those platforms in our guide to zero-code website builders. Your shop plugins, booking forms and old landing pages on other hosts still count, though, so check them too.

Which PHP versions get the fix?

PHP's advisory says every version before the fixed releases is affected. Ask your host for the version in the right-hand column:
If your site runs PHPAsk your host for
8.58.5.12
8.48.4.27
8.38.3.36
8.28.2.35, then plan a move before 31 Dec 2026
8.1, 8.0 or 7.xA patched package from your host, and a move to 8.3 or newer
And here is how long each version keeps getting security fixes, from PHP's supported versions page:
PHP versionGets security fixes?Until
8.5Yes31 Dec 2029
8.4Yes31 Dec 2028
8.3Yes31 Dec 2027
8.2Yes31 Dec 2026
8.1, 8.0, 7.x, 5.xNo, end of lifeAlready ended
PHP confirmed that versions 8.1 and older get no official release; its security team only published code fixes that hosting companies and Linux distributions can build in. And here's the uncomfortable number: by our calculation from W3Techs data, nearly half of all PHP websites (about 48%) run one of those unsupported versions. Small business sites are often the ones nobody has touched since launch day, which puts many of them in that group.

What should a bootstrapping founder do today?

You don't need a security team for this. You need 30 minutes and access to your hosting account. Here's my plan:
  1. Make a list of every website you own. Your main site, your shop, the event page from 2023, the old blog. Write down who hosts each one. Forgotten sites are the easiest targets, and a hacked one still carries your name.
  2. Check the PHP version. Log in to your hosting panel and look for "PHP version" or "PHP settings". In WordPress, go to Tools, then Site Health, then Info, then Server. Note the number.
  3. Email your host. Use the short message below. Good hosts answer the same day, and their answer tells you whether you're in safe hands.
  4. Take a full backup. Download your files and database, or use your host's backup button. Do this before any update, so you can roll back if something breaks.
  5. Move off old PHP this month. If your site runs PHP 8.1 or older, ask your host or freelancer to switch it to 8.3 or newer, and test your contact forms and checkout afterwards.
  6. Check again tomorrow. Confirm the new PHP version is live and your site still works. Then add "check PHP version" to your quarterly admin list.
Copy this message to your host, and change the details:
Hi, PHP released a critical security update on 21 October 2026 (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). My website [your domain] runs on your hosting. Can you tell me when you will install the fixed PHP version on my server, and which PHP version my site uses now? If my site is on PHP 8.1 or older, please tell me how to move it to a supported version. Thank you!
If you'd like the bigger picture on keeping a small company safe, start with our cybersecurity essentials for non-technical entrepreneurs and our list of data security practices for startups. A hacked site can also expose customer data, which brings GDPR duties, so keep our guide to GDPR compliance for European startups close.

Do I need to pay for a developer or a security tool?

For most small websites, no. Good hosting does the heavy lifting, and most of the steps above are free. Pay for help in two cases: when your site runs on PHP 8.1 or older and nobody knows how to update it, or when you run your own server. A freelancer will charge far less for a planned update than for cleaning up a hacked shop.
For tech founders who run their own servers, our sister site MeanCEO has a deeper breakdown of what tech founders should patch first. And if you're picking tools on a budget, our list of essential free startup tools has a few free website and backup options. If you build websites for clients, femaleswitch.com has a 24-hour plan for freelancers who look after client sites. Engineering teams whose portals and download pages hold CAD files can follow CADChain's PHP checklist for engineering teams.
Building your first startup on a budget?

The Fe/male Switch startup game takes you from idea to first paying customers in weekly quests, with an AI co-founder and a community of founders.

👉 Start the game

More on this story

FAQ: the PHP vulnerability and small business websites

Is my WordPress site affected by the PHP vulnerability?

WordPress runs on PHP, so your site depends on the PHP version on your server. Updating WordPress or its plugins won't fix it. Your host, or whoever manages your server, needs to install the fixed PHP release.

Has anyone been hacked through the PHP vulnerability?

No successful break-in had been confirmed by 22 October 2026. Amazon and watchTowr report attack attempts, and the Dutch NCSC found that none of the public exploits it tested worked yet. Attackers keep trying, so get the fix installed anyway.

Which PHP version fixes the vulnerability?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. Ask your host which one your site runs after the update.

Are Wix, Shopify or Tilda websites affected?

On hosted website builders you don't manage a server, so there is no PHP version for you to update. The platform handles its own servers. Check any other sites, plugins or landing pages you run elsewhere.

How do I check my PHP version without a developer?

Look for PHP settings in your hosting control panel, or in WordPress go to Tools, Site Health, Info and then Server. You can also ask your host by email.

What does a CVSS score of 9.2 mean?

CVSS is the standard 0 to 10 scale for how dangerous a security flaw is. Scores from 9.0 to 10 count as critical, the highest level.

What if my site runs PHP 7 or PHP 8.1?

Those versions no longer get official security fixes from PHP. Ask your host or freelancer to move your site to PHP 8.3 or newer, take a backup first and test your forms and checkout afterwards.
2026-10-21 13:46 Startup News and Trends