The PHP security flaw, explained for small business owners

Short answer: On October 21, 2026, the people who maintain PHP — software that runs behind roughly 7 in 10 websites, including most WordPress sites — released an emergency update for two serious flaws. An outsider who knew how to use them could take over the computer running a website without a password, and read the passwords and other private information passing through it. Break-in attempts started within hours. If your website runs on PHP, ask whoever manages it one question today: “Has our PHP been updated since October 21?”

What happened?

Most small business owners have never heard of PHP, and that is how it should be. It works out of sight, a little like the plumbing in a building. When a customer fills in your contact form, books an appointment or checks out of your online store, there is a good chance PHP is doing the work behind the wall.

In August, a team of security researchers found two flaws deep inside PHP itself. These weren’t flaws in any one website. They were in the plumbing that millions of websites share. Some of it had been sitting there, unnoticed, for more than ten years.

The researchers reported the problem privately so it could be fixed before anyone else found it. On October 21, the fix was released to the public along with an announcement of the flaws.

Why does it matter to a small business?

Because of what the flaws let an outsider do. A website normally keeps visitors on the public side of the counter. These flaws let someone walk behind the counter, with no password and no account, and:

• Take control of the computer your website runs on, and use it to do whatever they want.
• Read private information passing through it, including passwords, customer details and the digital keys your website uses to connect to other services such as your payment system or email.

That last point is the one owners tend to miss. Your website is rarely just a website anymore. It is often connected to your booking system, your customer records or your payments. A break-in at the front door can become a way into everything behind it.

How fast did attackers move?

Very fast. Security companies watching internet traffic reported tens of thousands of break-in attempts within 45 minutes of the announcement, and millions by the next morning. Some attempts were spotted days before the public announcement. Security firms still disagree about how many of those attempts succeeded, but the message is the same: the window between “a fix is available” and “someone is trying the lock on your door” is now measured in hours, not weeks.

There is a reason for that speed. The researchers who found these flaws used AI tools to help find them and understand how they could be used. The same kind of tools are available to the people on the other side. AI is making it faster to find weaknesses, and faster to take advantage of them.

On October 23, PHP announced a third, related flaw. It only affects websites set up in an unusual way, and PHP has published a settings change that blocks it. It’s worth asking about, but it is not the main concern.

What should you do this week?

You don’t need to understand any of the technical details. You need to ask the right person the right questions. Send this to your web host, your developer, or whoever built your website:

1. Does our website run on PHP? If you use WordPress, the answer is almost certainly yes.
2. Has it been updated since October 21, 2026? The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything newer.
3. Are we on an old version that no longer gets updates? Versions 8.1 and older are past the end of regular updates. The U.S. government’s cybersecurity agency recommends taking those systems offline until they can be upgraded.
4. Is PHP running anywhere else in our business? It sometimes comes built into other software, such as a customer portal, an online store add-on or an internal tool.
5. Do we need the settings change for the October 23 flaw? Let them check; it takes minutes.
6. Has anything unusual happened since October 21? Unexplained crashes, error pages or slowdowns are worth a closer look.

If the answer to any of these is “I’m not sure,” that is your answer: ask them to find out today.

How does this connect to the automations we build?

When we build an automation or an AI agent for a client, we are connecting systems together: your website to your customer records, your inbox to your calendar, your forms to your accounting. That is the whole point. It is also why security can’t be an afterthought. Every connection is a door, and every door needs a lock that someone checks.

So we harden every build we hand over. On every engagement:

• Two-step sign-in wherever the system allows it. Where an older system can’t, we agree other safeguards with you in writing.
• Passwords live in a password manager, never sent by email or text.
• Every automation keeps a log of what it did, so nothing happens in the dark.
• Our access is removed when the work is handed off, or any time you ask.
• We’ll sign an NDA, or a business associate agreement when patient information is involved.

And because no one person can keep up with how fast this is moving, we don’t try to do it alone. We work with two partners:

• A cybersecurity professional with more than 20 years in the field and a deep interest in how AI is changing security.
• A firmware specialist — someone who works on the software built into hardware itself — who has worked for Intel and for one of the largest U.S. defense contractors, and who has a professional interest in network security.

Together, our job is to stay at the leading edge of automation, AI agents and business system security, so you don’t have to. When something like this PHP flaw breaks, we want to already be asking the questions above on your behalf.

What is the bottom line?

The PHP flaw is fixed, but only on websites that have been updated. Ask whoever runs your website whether yours has been, and don’t settle for “probably.” And when you connect your business systems together, with us or with anyone else, ask how each connection is locked, who checks it, and who will tell you when something like this happens next.

Frequently asked questions