New critical PHP flaw · 21 Oct 2026
Anyone can take over an outdated PHP website.
No password needed. If your site runs PHP 5 or 7, there's no official fix.
37%
of PHP websites run PHP 5 or 7. There's no official fix for them.
In the news
What it costs a business
Once an attacker controls your web server, they control everything it touches.
Customer data leaked
Names, emails, orders and passwords copied out of your database.
Website held for ransom
Files encrypted. Your site stays down until you pay or rebuild.
Card details stolen
Hidden code on your checkout page sends customers' cards to criminals.
"This site may be hacked"
Google warns visitors away. Customers stop trusting you.
It has already happened
Attackers move within days of a PHP flaw going public.
-
Attacks began before the fix existed
Amazon's sensors caught the first attempt on the new PHP flaw four days before the fix was released.
Source: Amazon -
Tech, telecom and e-commerce firms in Japan broken into
Attackers used an older PHP flaw to get in, steal passwords and wipe their tracks.
Source: Cisco Talos -
About 1,000 servers held for ransom
A ransomware gang started using a PHP flaw two days after the fix came out. Owners who hadn't patched lost access to their files.
Source: Cybersecurity Dive -
Government websites mining crypto for strangers
Hundreds of sites, including a US Attorney General's office, were hijacked through a PHP website flaw. Patching later did not remove the malware.
Source: SecurityWeek
How we fix it
One team, from the first check to go-live.
Patch
We update PHP on every server you run and check the fix is working.
For sites on PHP 8.2 to 8.5
Upgrade
We move your site to a newer PHP version and test it before it goes live.
For sites on PHP 5, 7, 8.0 or 8.1
Protect
If your site can't move yet, we shield it and check nobody got in.
For sites that need cover today
- 1
Check
We find every website and server you run, and the PHP each one uses.
- 2
Secure
Anything exposed gets patched or shielded first.
- 3
Upgrade
We fix and test a copy while your live site keeps running.
- 4
Go live
We switch over at a quiet time, with a way back if needed.
Questions owners ask
Our hosting company manages the server. Aren't they handling this?
Maybe not. Many hosts let you pick your PHP version, and an old one stays old until someone changes it. Ask them, or send us your website address and we'll check.
Will our website go down while you fix it?
No. We test everything on a copy first, then switch over in your quiet hours with a way back if anything looks wrong.
How long does it take?
Patching usually takes hours. Upgrading an older website takes days to a few weeks, depending on its size. You get a clear estimate before any work starts.
We haven't been hacked. Why act now?
Attacks on PHP flaws have started within days of them going public, and attackers scan the whole internet automatically. Fixing it now costs far less than cleaning up after a break-in.
Know your PHP version?
Tap your version to see if it's safe.
Don't know your PHP version?
Your website runs on
Version
Runs only on PHP 7.4 – 8.1. None of these get official fixes. Ask us to check →
Want us to check for you?
Add your website address and send. We'll tell you which PHP it runs and what to fix first.