Critical PHP security alert: two vulnerabilities highlight the importance of website maintenance

A new security alert affecting PHP, a technology used by websites and online stores, reminds businesses that keeping systems updated is essential to protecting information and maintaining operations.

The PHP security team announced an exceptional release addressing two critical vulnerabilities, each rated 9.2 out of 10 under CVSS 4.0.

The official announcement dated 20 October schedules the release for 21 October 2026 at 14:00 UTC, or 16:00 in mainland Spain. PHP may release earlier if technical details become public or evidence of active exploitation emerges.

The advance notice gives administrators, developers and businesses time to prepare for prompt patching. It also raises a practical question: can your business respond when a critical vulnerability affects its website?

What happened and why does it matter?

PHP is widely used to build websites, ecommerce systems and business applications. WordPress, WooCommerce, Drupal, Joomla and PrestaShop rely on PHP for important parts of their operation.

On 20 October, PHP announced two critical vulnerabilities and an exceptional security release. CERT-EU also issued an advisory describing possible remote code execution, based on preliminary information.

Depending on the specific conditions required for exploitation, such a vulnerability could allow an attacker to execute malicious instructions on an affected server. Possible consequences include unauthorised access to business or customer information, altered files and content, an unavailable online store, malicious code or persistent access, and compromise of other services on the same infrastructure.

The advance announcement did not include definitive technical details or fixed versions. PHP said these would accompany the release. The alert does not establish that every PHP website has been compromised. Businesses should identify their installations and prepare an appropriate response.

Which websites should be reviewed?

Any business using PHP should check its infrastructure, particularly in the following situations.

Corporate WordPress websites. Even a site that mainly presents company information depends on a content management system and components that may contain vulnerabilities.

WooCommerce and PrestaShop stores. An incident can interrupt product browsing, checkout, order processing, integrations or store availability.

Custom business applications. Customer portals, intranets, management systems and platforms connected through APIs may also use PHP.

Servers running older versions. Unsupported PHP branches increase exposure because newly discovered vulnerabilities may no longer receive official fixes.

Actual exposure depends on the affected versions, server configuration and exploitation conditions confirmed by the vendor. The use of PHP alone does not determine whether a particular installation is exploitable.

What should your business do?

Sitelicon recommends an organised response with clear responsibilities and checks.

1. Identify the PHP version in use

Check which PHP version actually runs each website or application. Use hosting management tools or administrative access rather than publishing diagnostic pages containing server information.

A hosting account’s default configuration may differ from the runtime used by a particular site. Check whether that runtime still receives official security updates.

2. Inventory exposed systems

Include more than the main website. Review online stores, subdomains, internet-accessible internal applications, integrations and other PHP services.

An up-to-date inventory should make it easier to locate the relevant systems, identify their owners and plan the work when a security alert appears.

3. Prepare verified backups

Before significant changes, obtain a recent, recoverable copy of the relevant files, databases and configuration.

A backup is useful only when the team knows how to restore it. Confirm that the recovery procedure works and that the necessary access and responsibilities are available.

4. Apply security updates

As fixed releases become available, identify affected systems and prioritise their updates according to official guidance and application compatibility.

When PHP comes from a hosting provider or an operating-system distribution, consult that provider’s advisories as well. It may supply the correction through its own packages. Check the applicable advisory rather than relying solely on an upstream version number.

5. Verify essential functions

After updating, confirm that the website’s important business processes still work. For an online store, test the cart, payment flow, orders, notifications and integrations with other systems.

The objective is to resolve the security issue while maintaining the workflows on which customers and internal teams depend.

6. Monitor and contain exposure

If patching cannot happen immediately, assess temporary protections. These may include access restrictions or isolation of exposed services where appropriate.

Review logs and alerts for suspicious behaviour. Temporary restrictions need an owner and a plan for applying the permanent fix; they should not become a forgotten substitute for maintenance.

The recurring problem: websites without maintenance

Businesses often invest in building a website and then consider it complete once launched. Months or years can pass without a structured maintenance process.

Yet a website is a changing technology system. Servers, runtimes, content management systems, extensions, libraries and integrations receive updates, and new vulnerabilities appear over time.

A website can appear to work normally while relying on outdated components or carrying significant security risks.

Updating an installation neglected for years can also become a larger project. Compatibility problems between runtime versions, extensions and custom code can require more extensive technical intervention.

Regular preventive maintenance helps manage those dependencies continuously and makes security, stability and business continuity part of normal operations.

What should professional website maintenance include?

A maintenance service should provide prevention, correction and follow-up, alongside a clear way to report incidents.

Relevant activities include:

• Updates: maintain the CMS, extensions, code and server components included in the agreed service.
• Security monitoring: review relevant vulnerabilities, configuration and alerts.
• Backups: maintain suitable copies and recovery procedures.
• Availability monitoring: detect interruptions and unusual behaviour.
• Compatibility checks: verify that updates preserve essential functions.
• Incident response: define responsible people, procedures and response arrangements.
• Ongoing development: adapt the platform to changing business and technical requirements.

The contract should specify covered applications and infrastructure, task frequency and the process for critical incidents. A service description should make it possible to understand what the team will actually maintain.

What can neglecting maintenance cost?

The consequences extend beyond the technical repair. For an online store, downtime can mean lost orders, wasted advertising spend and customers moving to competitors.

A corporate website incident may damage reputation, interrupt lead generation or expose information. If personal data is affected, the business may also need to assess applicable notification duties and other responsibilities.

Investigation, restoration and recovery add further work. A preventive maintenance plan can make this effort more predictable than repeated emergency interventions after a failure.

Why a responsive technology provider matters

A critical vulnerability requires knowledge of the infrastructure, rapid identification of affected assets, risk assessment and appropriate action.

A professional maintenance team therefore needs to understand the platform and its dependencies, as well as the procedures and people involved. Installing an update is one part of that responsibility.

For more than 20 years, Sitelicon has helped businesses build and maintain digital platforms, including corporate websites, ecommerce stores, integrations and custom business systems.

Our approach combines development, infrastructure, maintenance and ongoing improvement so that digital platforms remain stable and useful to the business.

When did you last review your website’s security?

The PHP alert is a reminder to make security a continuous process. Your business should know which PHP versions it uses, whether applicable security updates are installed, whether backups can be restored and who is responsible for responding.

It should also know whether its maintenance agreement covers critical vulnerabilities and the infrastructure involved.

If those answers are unclear, review the platform and define an appropriate maintenance plan. Sitelicon can help assess technical condition, identify risks and set priorities.

Explore website maintenance, AWS, cloud and systems or WordPress development, or contact Sitelicon to discuss your platform.