Security updates for PHP, the programming language behind a large share of the world's websites, are due out today at 16:00 Dutch time (14:00 UTC). The PHP security team announced yesterday that the release fixes two critical vulnerabilities. Advance notice like this is unusual, and it gives administrators a few hours to prepare. That time is well spent.
What is going on
PHP rates both flaws at 9.2 out of 10. According to researchers at watchTowr, quoted by BleepingComputer, they allow an attacker to run their own code on the web server remotely. PHP will only publish technical details, affected versions and fixed versions with the release itself. No exploitation has been seen so far, although PHP says it may publish earlier if details leak or attacks appear.
The pattern is familiar: once an update is out, attackers can compare it with the previous version and work out the flaw. The window between release and installation is when the risk is highest.
What this means for your organisation
PHP sits underneath almost every WordPress site, many online shops and all kinds of customer portals, intranets and booking systems. Business owners often do not even know their website runs on PHP, because their hosting provider or web agency looks after it. That is exactly where the risk lies: nobody feels responsible for the update.
If a web server is taken over through a flaw like this, an attacker can alter the site, redirect visitors to phishing pages, pull customer data from the database or tamper with payment pages. For an online shop that affects revenue, trust and your obligations under the GDPR.
What you can do today
- List what runs on PHP. Think of your website, online shop, customer portal and internal web applications, even if different parties host them.
- Contact your hosting provider and web developer. Ask specifically whether they will install today's update as soon as it is released, and when you will receive confirmation.
- Check the PHP version. If a site still runs on a version that is no longer supported, there may be no update for it. That calls for an upgrade rather than waiting.
- Make sure you have a recent backup. A clean, tested backup of the site and database makes recovery simple if something does go wrong.
How Qteco helps
For clients whose web servers we manage, we schedule the PHP update as soon as it is published, test that applications keep working and confirm once everything is up to date. If your website or online shop is hosted elsewhere, we help you ask the right questions and, where needed, check the version and configuration. We also keep an eye on reports of exploitation and apply extra measures if required, such as stricter filtering in front of the web server.
Not sure whether your website, online shop or portal will be updated in time? Book a call with one of our engineers and we will go through it with you.
Sources
- Upcoming Critical PHP Security Release — PHP.net (2026-10-20)
- PHP warns admins of two critical flaws, emergency patches coming tomorrow — BleepingComputer (2026-10-20)
Read also
Firewalls and VPNs under fire: how to keep the door shut
Ready to run worry-free?
Book a no-obligation introduction. We map your IT and security and show where the difference lies.
Book a call →