Opens in a new tab

PHP security crisis: What small businesses need to know

:
23 October 2026
:
Alert

A serious new cyber-security threat has emerged that could put business websites and online systems at risk.

The problem affects PHP, a technology used behind the scenes by many websites, portals, and online applications. You don’t need to know whether your system uses PHP, or even what PHP does. What matters is that your vendor, developer, IT or Managed Service Provider does.

Two critical security weaknesses have been discovered that could allow cybercriminals to take control of vulnerable systems remotely, without first needing to log in. Security updates were released on 21 October, and organisations are being advised to act immediately.

For a small or medium-sized business, a vulnerable website could mean disruption to your online services and potentially put business or customer information at risk.

What should you do?

Contact your website developer, hosting company or IT provider today and ask:

“Is our website or any of our online systems affected by the recent PHP security vulnerabilities, and have they been updated?”

You should also:

  • Ask for confirmation that security updates have been installed, rather than assuming automatic updates have taken care of the problem.
  • Check all your online systems, not just your main website. PHP can be hidden inside other software and services.
  • Prioritise anything accessible from the internet, including websites, customer portals and other online applications.
  • Ask your provider to check for signs of suspicious activity if your systems were vulnerable.

Don’t put it off

For business owners, the message is simple: you don’t need to fix this yourself, but you do need to make sure somebody has.

Make that call or send that email today.

Details for techies
Contact us