WordPress
22. October 2026
Critical security update for PHP: What does it mean for your website?
On Wednesday, 21 October 2026, an important security update was released for PHP, which is used to run many websites and web applications. What does it mean for you?
What is PHP? And what does it have to do with your website?
PHP is a programming language used to build the functionality behind websites, online shops, and web applications. Think of it as the engine on the server that pulls together data and content before the finished page is shown in the user’s browser.
For example, PHP may process a quote request, give a customer access to a portal, or retrieve product information from a database. PHP is also used in WordPress, so your website may be affected even if you have never had to think about the programming language yourself.
If you would like to learn more about the technology, you can read our post here:
Overview of the incident
The process stretched over several months, but it was especially the final 24 hours before the release that caused the rush:
- 11 August: Calif and OpenAI independently report a critical vulnerability in PHP. Wiz reports additional attack vectors on 24 August.
- August–October: PHP’s security team and partners work confidentially on fixes and mitigations.
- 20 October: The vulnerabilities’ identification numbers, the so-called CVE numbers, begin circulating publicly. In the evening, a video demonstrating an attack is accidentally published.
- 21 October at 05:02: Cloudflare enables protection against known attack attempts for customers using its security filter—also on the free plan.
- 21 October in the afternoon: PHP releases the security fixes. The release had been scheduled for 16:00, one day earlier than originally planned.
All times are Danish time. Read more at PHP Foundation and Cloudflare.
Why is the security update important?
The update closes two critical security vulnerabilities in PHP. They can allow unauthorised parties to make the server behind your website perform harmful actions without logging in first. For that reason, the PHP team recommends updating affected installations immediately.
If the vulnerabilities are exploited, it can affect the company’s data and the operation of your website. It can also impact sales if, for example, customers cannot submit quote requests or access a customer portal.
The fact that your website uses PHP does not, in itself, mean it has been hacked. However, you should ask your hosting provider or web partner to check whether it is protected.
Several well-known Danish websites shut down for security reasons
On Wednesday, 21 October, the vulnerabilities had consequences for websites worldwide—including a number of well-known Danish websites and services. One of them was Aula, which was taken offline (some of us were, in this particular case, a little relieved for once to have a good excuse not to check messages in there).
DMI, the City of Copenhagen, the Danish Road Directorate, and the libraries’ websites were also temporarily unavailable as a precaution while the security issue was handled.
Why did it become so hectic?
The planned release was moved forward by one day as information began circulating. That gave hosting providers and operations teams less time to prepare.
At the same time, attack attempts were already underway. AWS has since stated that it detected an attempt to exploit the vulnerabilities on 17 October—four days before the public disclosure. This was an attempted attack, not evidence of a successful breach at companies.
That is why it is not enough to install the fixes and only review activity after 21 October. The checks should also cover the period before the disclosure—at a minimum from 17 October. Read AWS’ review.
What should you do now?
1. Contact your hosting provider or web partner
If your website uses PHP, you should ask your hosting provider or web partner as soon as possible to confirm that the security fixes have been installed. At the same time, ask them to clarify whether you have other PHP-based solutions that also need to be updated.
Remember, for example, customer portals, online shops, and older solutions that are still accessible online. It is easy to focus on the company’s primary website and overlook the other systems.
If you use WordPress, you can find the PHP version under Tools → Site Health → Info → Server. It may also appear in your hosting control panel.
2. Have the PHP installation itself updated
It is PHP on the server that must be updated. Updating WordPress, themes, or plugins does not, by itself, close these vulnerabilities.
PHP has released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some server providers deliver security fixes to their existing packages. Therefore, ask the provider to confirm that the fixes are installed, rather than only looking at the version number.
PHP 8.1 and older no longer receive regular security updates from the PHP project. In these cases, the provider must clarify whether a fix is available or whether the solution must be upgraded to a supported version.
If you use PHP 8.2, you should also put a plan in place for the next upgrade. The PHP project’s security updates for this version end on 31 December 2026.
Also ask the provider to confirm that the relevant services have been restarted after the update so the fixes have taken effect.
You can find version details and recommendations in PHP’s official security announcement.
3. Follow up on functionality and signs of misuse
Agree with your provider who will check the solution after the update. Can customers submit a quote request? Does login to the customer portal work? Do orders and form enquiries reach the right recipients?
Also ask the technical owner to investigate signs of compromise from at least 17 October onwards. This can include, for example:
- PHP repeatedly crashing or restarting unexpectedly.
- Unknown programs or commands being started on the server.
- New PHP files in folders for uploaded images and documents, where there should not be any code.
- Many unusual requests or attack attempts from the same IP address.
None of these signs alone proves there has been a breach. However, they are relevant to investigate further. You do not need to review the server yourself—use the points to ask about the provider’s checks.
4. Watch for errors after the update
A separate bug has been confirmed in PHP 8.4.27 and 8.5.12, which under certain conditions can cause PHP to crash. This makes post-update checks even more important.
If you experience issues, the provider must investigate them and follow PHP’s fixes. Rolling back to a version with the original vulnerabilities will reintroduce the risk and should not be the default solution. See the PHP project’s bug report.
What if you do nothing?
If your website is affected and is not updated, the vulnerabilities remain open. This can allow unauthorised parties to access data or disrupt operations.
Cloudflare has enabled protection against known attack attempts for customers using its security filter, also on the free plan. If you already use Cloudflare, the provider should check that the protection is active and that website traffic is routed through it.
If you do not use Cloudflare, the provider can assess whether it is a relevant additional measure while the update is being implemented. However, it is not enough simply to create a free account, and the filter does not replace the security fixes. Read Cloudflare’s guide.
If you have not yet had confirmation that the fixes are installed, contact your hosting provider or web partner as soon as possible. If the update cannot be completed immediately, the operations owner should also assess whether access should be temporarily restricted or shut down.
With a service agreement, we take care of the updates
If you have a service agreement with us, we have already handled this update. Four colleagues worked late into the evening on 21 October, and by 21:30 we had updated and restarted more than 500 websites.
We continuously and automatically monitored when the fixes became available from our providers, so installation and restarts could begin as soon as the packages were ready. Websites where we manage DNS were already behind Cloudflare and had protection against known attack attempts from the morning.
We are also reviewing all servers for signs of compromise from 17 October onwards and monitoring new security information.
That is also what a service agreement is for. You should be able to do your job while we keep an eye on security updates and respond when needed.
Would you also like someone to take care of operations?
Written by
Let us talk about your digital project
Let us go into the details so we can find solutions together that fit your needs.