Critical PHP Vulnerabilities: What Businesses Need to Know

North Risk Partners is sharing this notice as a public service. It summarizes publicly available information from the PHP Security Team and the Cybersecurity and Infrastructure Security Agency (CISA).

What Happened

Two critical security vulnerabilities were recently discovered in PHP (Hypertext Preprocessor), a programming language used behind the scenes to run many websites and online applications. According to public advisories, these vulnerabilities could allow an attacker to take control of an affected web server without a password or login. The PHP Security Team released security updates on October 21, 2026.

Who May Be Affected

Your organization may use PHP without realizing it. It can be built into:

  • Business websites
  • Online stores and payment pages
  • Customer or vendor portals
  • Website platforms such as WordPress, Drupal, and Joomla
  • Software or online tools managed by outside vendors

Even if your website’s content and applications are current, the underlying PHP software may still need to be updated. This is why businesses should check with their website or technology provider rather than assume their systems are protected.

Why This Matters

If an attacker gains access to a vulnerable web server, the incident could lead to:

  • Theft of customer information, passwords, or other sensitive data
  • Installation of ransomware or other malicious software
  • Changes to website content, payment pages, or links
  • Phishing messages that appear to come from your organization
  • Website outages and business interruption

Because hosting companies, website agencies, and other vendors may manage this technology for you, your internal team may not see the issue.

What Your Business Should Do

Contact your Information Technology (IT) team, website developer, digital agency, Managed Service Provider (MSP), or hosting company and ask them to review the official guidance below. Your IT support team is best positioned to determine whether your organization is affected and what action to take.

Determine whether PHP is used. Ask them to check your primary website, secondary websites, customer and vendor portals, online payment pages, and other public-facing applications.

The PHP Security Team recommends that you install the security update and restart the affected services. Systems should be updated to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or to a patched version supplied by the applicable hosting or software provider. Restarting the service is important for the update to take effect.

Plan for systems that cannot be updated right away. If an update cannot be applied promptly, ask your provider about taking the affected website or application offline until it is updated, as recommended by the Cybersecurity and Infrastructure Security Agency (CISA). Web application firewalls may offer limited, temporary protection but do not replace the update.

Check for suspicious activity. Ask your provider to review systems and server records for possible signs of unauthorized access.

Review older PHP versions. PHP 8.1 and earlier are no longer officially supported. If an older version is in use, ask the provider whether a vendor-supplied security update is available or whether the system should be upgraded.

Contact important technology vendors. Ask vendors that host websites, portals, or applications on your behalf whether they use PHP and whether the security update has been applied.

Keep written confirmation. Request documentation showing the PHP version, the date the update was applied, confirmation that services were restarted, and the results of the security review.

If Your IT Support Team Suspects an Incident

If your provider finds signs of unauthorized access, unusual website activity, or other suspicious changes:

  • Follow your IT or technology provider's guidance to contain the issue, including disconnecting affected systems from the internet if recommended.
  • Report the potential incident directly to your insurance carrier.*
  • Preserve system records and other evidence. Avoid wiping or rebuilding affected systems unless your incident response provider directs you to do so.
  • Document the actions taken and the associated dates.

*Cyber incidents and coverage circumstances vary. Review your specific policy requirements with your broker or insurance carrier before engaging outside response providers or incurring significant costs.

Takeaways

Businesses with a website, portal, or other internet-facing application should contact their technology provider as soon as possible. The most important step is to obtain written confirmation that PHP has been updated, the affected services have been restarted, and the environment has been reviewed for suspicious activity.

If you have questions, please contact your North Risk Partners Risk Advisor. Don't have an advisor? No problem. We'll help you find one.

Find an Advisor

North Risk Partners is sharing this notice as a public service. It summarizes publicly available information from the PHP Security Team and the Cybersecurity and Infrastructure Security Agency (CISA) and is provided for general awareness only. It is not technical, legal, or insurance coverage advice. North Risk Partners has not assessed and cannot confirm the status of your systems; your IT team or technology provider is responsible for determining whether you are affected and for any remediation. This situation is developing, so refer to the linked sources for current guidance. Nothing in this notice changes the terms, conditions, or coverage of any insurance policy. Information current as of October 23, 2026.

Posted in Cyber Updates