News
Critical PHP Vulnerability: What Website Owners Need to Know
A critical security flaw in PHP is affecting websites worldwide, with governments taking sites offline as a precaution. Here is what it means, what the patch covers, and what to...
A critical security flaw in PHP is affecting websites worldwide
On 22 October 2026, cyber-security agencies across the UK, US, EU, Australia, and Japan issued urgent warnings about two critical vulnerabilities discovered in PHP - the programming language that quietly powers a large portion of the internet.
If your website runs on PHP, this applies to you. Here is what is happening and what to do.
What was discovered
Two critical flaws were found in PHP by cyber-security researchers using advanced AI tools through OpenAI's Patch the Planet programme. The vulnerabilities had gone undetected for over a decade, dating back to PHP 5 which launched in 2004.
The European Union's CERT-EU confirmed that the flaws could allow unauthenticated remote code execution - meaning an attacker could potentially take control of a server without needing a login.
How widespread is it
PHP powers WordPress, Drupal, Joomla, Magento, most shared hosting control panels, and a huge amount of software that does not even advertise that it runs PHP under the hood. Cyber-security firm Wiz has estimated roughly 70% of the internet is affected.
Governments and agencies have already taken sites offline as a precaution - including parts of the Finnish and Dutch governments, Edinburgh Council, and the BBC itself.
A patch has been issued - but only for PHP 8.2 and above
PHP Foundation released a fix on 22 October 2026. If you are running PHP 8.2 or newer, the update is available now. If you are on PHP 8.1 or older, you will need to upgrade your PHP version first before you can apply the fix.
The UK's National Cyber Security Centre (NCSC), along with its EU and Australian counterparts, have advised that where immediate patching is not possible, organisations should consider taking their systems offline until the fix can be applied.
What to do right now
- Check what PHP version your hosting runs
- If on PHP 8.2 or above, apply the update immediately
- If on PHP 8.1 or older, upgrade your PHP version first
- Ask your hosting provider what they are doing about it
- Monitor for signs of suspicious activity or unusual server behaviour
If you are on Hulme Tech hosting
Our servers run multiple versions of PHP to support different client environments. We are applying the security patch across each version as it becomes available and monitoring all hosted sites for unusual activity.
If you have concerns about a site we manage, get in touch and we will check it with you directly.
What this event shows about modern security
The fact that these flaws went undiscovered for over a decade shows just how much invisible risk sits underneath everyday websites. The discovery was only possible because AI tools were pointed at the codebase with enough time and compute to find what human reviewers had missed.
It is a reminder that security is not a one-time setup. It is ongoing: updates, monitoring, and knowing what is running on your server.
Need help checking your site?
If you are unsure what PHP version your site runs, whether your hosting has been updated, or whether your site may have been affected, we can check it for you.