Today, October 21, 2026, the team that maintains PHP announced two critical security flaws and released fixes the same day. PHP is the software that runs a large portion of the world's websites, including most WordPress sites. If your website runs on PHP and hasn't been updated, an attacker could potentially take control of it without needing a password or login of any kind.
The PHP team rated both issues as critical and is urging everyone to update immediately. The good news is that the fix is already available, and most hosting providers received it in advance so they could prepare.
Does this affect my website?
If your website runs on PHP, it is likely affected until your host applies the update. This includes many common setups:
- WordPress, Joomla, Drupal, and similar website platforms
- Online stores built on WooCommerce, Magento, or similar
- Client portals, booking tools, and contact forms built in PHP
Very old versions of PHP (8.1 and earlier) no longer receive official updates. If your site still runs on one of these, talk with your host about moving to a newer version.
If you're not sure what your website runs on, your webhost can tell you in a few minutes.
What you should do
Reach out to your webhost today. The company that hosts your website is the one that can apply this update, and most are already working on it. When you contact them, ask:
- Has PHP on my website been updated to address the October 21, 2026 security advisory?
- If not, when will it be updated?
- Is my site running a version of PHP that still receives security updates?
If your host confirms the update is done, all necessary steps have been taken. If they can't give you a clear answer, or if your website is managed by a former developer or agency you're no longer in touch with, let us know and we'll help you sort it out.
We're here to help
Security news like this can feel intimidating, but we're here to help you handle it. The SpireTech team is happy to help you figure out where your website is hosted or answer any questions about what this means for your business.
If you're an existing client of SpireTech, reach out to our service desk the way you normally would, and we'll take it from there.
For a more detailed and technical explanation, the PHP team's full announcement is available on the PHP website.