SALTO
PHP is the language behind a huge part of the web, and many business owners use it without knowing. The topic became global news: governments and companies took pages offline as a precaution, and the security firm Wiz estimated that about 70% of the internet could be affected (a figure the BBC could not verify). This guide explains, without jargon, what happened, how to tell whether your business is at risk, and what to do today.
What happened with PHP?
Two critical vulnerabilities, scored 9.2 out of 10 on the CVSS v4.0 scale, were disclosed and fixed. According to the official advisory, they can allow unauthenticated remote code execution: in practical terms, someone on the internet could take control of a server, install malicious code, or reach files and databases. The risk is highest on servers using Apache's mod_php module, but the advisory also lists PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
Cloudflare reported early attacks already under way. That means the window between disclosure and fix is short, and delaying is a real risk to your business.
Which platforms and systems use PHP?
If your website, store or system was built on any of the platforms below, it runs on PHP and needs attention:
| Type | Platforms that use PHP |
|---|---|
| Websites and blogs | WordPress (including sites built with Elementor, Divi and other page builders), Drupal, Joomla |
| Online stores | WooCommerce (WordPress), Magento, PrestaShop, OpenCart |
| Custom system frameworks | Laravel, Symfony, CodeIgniter |
| Ready-made applications | Moodle (online courses), MediaWiki, phpBB (forums), Nextcloud, Matomo, phpMyAdmin |
| Hosting | Shared hosting, control panels such as cPanel, and third-party software that embeds PHP without saying so |
Website tools hosted by third parties, where you do not manage the server, leave the update to the provider. Even so, ask them whether the fix has already been applied.
How do I know if my website uses PHP, and which version?
- Ask whoever manages your website. The question is simple: "which PHP version runs my website, and when was it last updated?" If the answer is slow or missing, that is already a warning sign.
- On WordPress: in the dashboard, open Tools, then Site Health, the Info tab, Server section. The PHP version is listed there.
- In your hosting panel: look for "PHP Version", "Select PHP Version" or "PHP Configuration". Most providers let you view and change the version in a few clicks.
- With server access: the command
php -vshows the version. On Linux servers, some distributions apply the fix without changing the version number, so also check your system vendor's advisory.
Compare the result with the list of fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Any lower version within those branches, or any 8.1 and older version (including 7.x and 5.x), needs action.
What to do today to protect your website
- Take a full backup of the site and the database before changing anything.
- Update PHP to one of the fixed versions. On shared hosting this is usually a switch in the panel; on your own server or VPS it is a package update.
- Update the system and plugins (WordPress, themes, plugins, Magento, PrestaShop and so on). Very old versions may break when PHP is upgraded, so test the site after the change.
- If your PHP is 8.1 or older, plan the migration to a supported version. Some vendors offer specific fixes for old versions, but get that confirmed in writing.
- If you cannot update right now, security agencies recommend considering isolating the site or taking it offline until it is fixed. A web application firewall, such as the rules Cloudflare released, helps as a stopgap, but the official advisory is clear: only updating truly solves it.
- Look for signs of compromise: unknown files in site folders, new administrator users, strange redirects, spam pages, sudden slowness or Google warnings.
Are partial mitigations enough?
No. The official advisory lists configuration changes that reduce exposure if you cannot update right away, but states that they do not make an installation safe. Use them only as a bridge until the update, and ask a professional to apply them, since every server has its own particularities.
When to call a specialist
Get help if you do not know which version runs on your website, if whoever manages it does not respond or has no update plan, if your website is a store that takes orders and payments, or if you found any sign of compromise. In those cases, Salto Solutions provides an objective technology consulting engagement: we map what runs under your website, validate versions, apply the fix with backups and testing, and leave an update and monitoring plan for the following months. For suspected intrusions, we also work in digital intelligence and forensics, preserving evidence.
Frequently Asked Questions
Was my website hacked because of this flaw?
Not necessarily. The flaw allows attacks, but only an analysis of the server shows whether there was an intrusion. Check the signs listed above and, if in doubt, ask for a technical assessment.
My website is built on WordPress. Should I worry?
Yes, because WordPress runs on PHP. The fix comes from updating PHP on the server, not from a plugin. Ask your host or developer which version is active and whether it has been updated.
My hosting is shared. Who updates it?
Usually the provider takes care of the server, but the PHP version your site uses is often chosen in the panel. Log in, check the version, and open a ticket with the provider to confirm the fix has been applied.
Can updating PHP break my website?
It can, especially on sites with old plugins and themes. That is why the backup comes first, and the switch should be followed by tests on the main pages, forms and checkout.
Is the "70% of the internet affected" figure reliable?
It is an estimate from the security firm Wiz, and the BBC said it could not verify it. What the official advisory confirms is that all PHP installations serving web requests are at risk until updated.
Want to know if your website runs PHP?
Use the free PHP Check: paste your website address and see in seconds whether it runs PHP or WordPress, the version when visible and a risk score. For a broader look at your site, take the website diagnostic or talk to Salto Solutions. You speak directly with the person who will review and fix it, with no middlemen.
Source and update: this guide was written on 10/21/2026, based on the official PHP project advisory, CERT-EU advisory 2026-018 and BBC News coverage. The situation changes fast, so always check the fixed versions on the official PHP page.