PHP Vulnerability Small Business: What to Do Now
A critical PHP vulnerability was disclosed this month. If your business website runs on PHP, it needs a software update soon. You do not need to understand the code to deal with it, only to ask your hosting provider or IT team the right questions. A regular IT Future-Proofing Strategy & Health Assessment keeps those answers on hand before the next alert arrives. Patched versions exist, and the first step is a phone call.
Key Takeaways
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, let attackers run commands on an affected server without logging in.
If your website uses PHP, it is at risk until it is updated to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 or newer.
The fastest way to find out whether you are exposed is to contact your hosting provider or IT team today and ask which PHP version your site runs.
PHP 8.1 and earlier will not receive a fix, so those sites need an upgrade, not just a patch.
Waiting leaves your site open longer, so ask for a patch date and written confirmation once the work is done.
What is a PHP vulnerability and why should you care?
PHP is a programming language that runs on web servers and powers many websites, content management systems, and web applications, according to Google Cloud. Two newly disclosed flaws in it let attackers run commands on a server without logging in. If your site uses PHP, those flaws affect you until it is patched.
A vulnerability is a mistake in software that someone can use to get in where they should not. This one matters because of who is saying so. In its alert Critical Vulnerabilities in PHP Require Immediate Patching, CISA, the U.S. government's cybersecurity agency, strongly urges organizations to patch right away. CISA says the flaws, nicknamed "php2shell," affect all PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.
CISA also added both flaws to its Known Exploited Vulnerabilities Catalog on Oct. 26, 2026. For a small business without a full-time security team, that is a clear signal to treat this as a priority this week.
How does a PHP vulnerability put your website at risk?
A PHP vulnerability gives an attacker a way in through the same web pages your customers visit. These two flaws allow unauthenticated remote code execution, meaning someone can run commands on your server without a password, along with memory disclosure, where data held in server memory can leak. The result can be stolen information or a hijacked site.
In its post Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, Google Cloud reports that each flaw carries a Critical severity score of 9.2. According to Google, a ranking like this generally means threat actors can crash and hijack the affected system and steal, alter, or wipe its data, although mitigating circumstances can make a flaw harder to exploit.
For a small business, that is a real small business cybersecurity risk. A website often holds customer contact details, orders, or login accounts, and a hijacked server can expose all of it or take the site offline. Google lists every PHP version from 5.4 through 8.5.11 as vulnerable, so the affected group is wide.
Running on a large cloud platform does not settle the question either. Google notes that Google Cloud itself is not vulnerable, but customers running PHP applications there may be. The platform supplies the server, and keeping your own PHP version current is still someone's job.
How do you know if your website uses PHP?
Your website probably uses PHP if it runs on a content management system, an online store, or a custom-built application. The quickest confirmation comes from your hosting provider or web developer, who can check in a short message. CISA notes that PHP is often a component of other software, so it may not be visible to you.
When you reach out, ask three things: does our site run PHP, which version, and who is responsible for updating it? Your hosting account's control panel may also list the PHP version, if you have access to it.
Check beyond the main website too. Customer portals, booking pages, and older internal tools can run on PHP without anyone remembering. CISA's guidance is to identify and inventory every system running any version of PHP, and that list is a useful document to keep.
Business owner on phone call at desk with laptop and notebook, taking notes during IT support conversation.
What steps should you take immediately?
Contact your hosting provider or IT team today, confirm which PHP version you run, and ask for an update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 or newer. Then get written confirmation that the patch is live. Anything on PHP 8.1 or earlier will not receive a fix and needs an upgrade to a supported version.
A PHP patch update is one task in a longer list of things worth planning for. Other risks of this kind are covered in Are You Ready? 2025's Top IT Threats You, which is worth a read once this fix is done.
Step 1: Contact your hosting provider or IT team today
Send a short message, or call, asking whether your site is affected by CVE-2026-109618 and CVE-2026-109619 and when the update will be applied. Name the specific patched versions so there is no ambiguity. CISA says to prioritize internet-facing systems, so mention your public website first and any customer portals right after it.
Step 2: Confirm your PHP version and patch status
Ask for the exact PHP version in writing. Anything from 5.4 through 8.5.11 is vulnerable, according to Google. If the answer is 8.1 or earlier, the fix is an upgrade, since the PHP project is not releasing patches for those versions. CISA advises that organizations that cannot update immediately should take PHP-based systems offline until they can be patched. It adds that a web application firewall, a filter that blocks suspicious web traffic, may offer some protection in the meantime.
Step 3: Verify the patch has been applied
Ask your provider to confirm the new version number, the date it was applied, and that every site and server was covered. CISA also recommends monitoring for suspicious activity, such as PHP processes launching shells or downloading tools. It has published a detection rule that technical teams can use, so ask whether someone is checking.
Two professionals collaborating at a desk during a business call, looking focused and positive.
When should you contact your hosting provider or IT team?
Contact them today, ideally before the business day ends. CISA lists these flaws in its Known Exploited Vulnerabilities Catalog and urges immediate patching, so a reply of "we'll get to it" leaves your site exposed in the meantime. Ask for a specific patch time and written confirmation when it is done.
If your provider hesitates, ask what protection is in place until the update happens. CISA's guidance gives two interim options: a web application firewall, which may provide some protection, or taking affected systems offline until they are patched. You can ask which of those applies to your site. You are entitled to a straight answer, and a provider who cannot give one has told you something useful about how closely your systems are watched.
A patched server covers one layer of security, and your team covers another. Staff habits matter too, as we explain in Phishing 3.0: Why Your Employees Still Click. A provider that responds quickly to alerts and a team that knows what suspicious email looks like work well together.
How do you prevent PHP vulnerabilities in the future?
Keep a current list of the software your business runs, assign someone to apply updates on a schedule, and replace versions that no longer get security fixes. Regular patching turns an alert like this into routine work. A monthly review with your IT provider keeps that schedule honest.
Website vulnerability management means tracking what your site runs, checking it against known flaws, and fixing the most serious problems first. The inventory CISA recommends is the foundation. Without it, nobody can say whether a new alert applies to you.
Support for older software also ends eventually. PHP 8.1 and earlier have reached end of life, which is why they receive no fix now. Putting upgrade dates on your calendar well before support ends is far cheaper than a rushed upgrade during an alert.
24hourtek is a San Francisco-based managed service provider serving the Bay Area and Denver. We meet with clients at least once a month to review strategy, security posture, and future-proofing guidance, and a Visual Scorecard is included with every plan. That monthly rhythm keeps updates on a schedule instead of waiting for the next alert. If you are unsure who owns your website's updates, ask that question first.
About 24hourtek
24hourtek, Inc is a forward thinking managed service provider that offers ongoing IT support and strategic guidance to businesses. We meet with our clients at least once a month to review strategy, security posture, and provide guidance on future-proofing your IT.