Skip to content

digizu.

Let’s talk

Website maintenance · Digizu

PHP security release: what website owners should do

If your business website runs on PHP, now is a good time to speak to whoever looks after its hosting. PHP is the software behind many websites, including WordPress and Laravel applications, and its security team has announced an urgent update.

What has been announced?

The PHP security team has scheduled a release for 21 October 2026 at 14:00 UTC (3pm UK time) to address two critical vulnerabilities, each rated 9.2 out of 10.

As of 6:10am UK time on 21 October 2026, the official announcement still describes an upcoming release. PHP has not yet published the full technical details or confirmed the affected and fixed versions. CERT-EU also advises preparing to patch promptly. This deserves attention, but the announcement alone does not mean your website has been compromised.

What should you do?

  • Ask your developer or hosting provider which PHP version your website uses and who will apply the security update.
  • Check that you have a recent backup of the website and database, with a way to restore it.
  • Arrange to install the appropriate patched version as soon as it is available through your hosting provider. Updating WordPress, plugins or Laravel alone does not update the PHP software on the server.
  • After the update, confirm the site is running the patched PHP version and test important journeys such as enquiries, logins, bookings and payments.

If you cannot patch promptly, ask your developer about temporary access restrictions. CERT-EU recommends considering isolation of internet-facing applications where immediate remediation is not feasible.

For sites managed through Laravel Forge, Forge has said in its customer email that it is working with the PHP Foundation to make patched versions available as soon as possible and will email when they are live. Check that confirmation before assuming your server is updated.

Need a hand?

We can help check your PHP setup, apply the appropriate update and test your website afterwards. If you’re unsure where to start, get in touch and tell us a little about your website and hosting.