Most business owners have never heard of PHP, and that’s fine. But on 21 October 2026, it was the reason web hosts and developers around the world spent the week scrambling. PHP released emergency security updates for two serious flaws, and attackers were already trying to use them. If your business has a WordPress website, this affects you, even if you never noticed a thing.
What Is PHP, in Plain Language?
PHP is the programming language that runs behind the scenes on most websites, including almost every WordPress site. You never see it, but every time someone opens a page on your site, PHP is doing the work of putting that page together. Think of it as the engine under the bonnet: WordPress, your theme and your plugins are the car you see, and PHP is what makes it go.
PHP lives on your hosting server, not inside WordPress. That means keeping WordPress and your plugins updated isn’t enough on its own. The PHP version on your server needs looking after too.
What Happened on 21 October
The PHP project released urgent updates (versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35) to fix two critical vulnerabilities. Both were rated 9.2 out of 10 for severity. In the worst case, they could let an attacker run their own code on a website’s server without needing a password or login.
Some key points:
- The problem was in PHP itself, not in WordPress, plugins or themes. WordPress didn’t need an update for this.
- Nearly every WordPress site was exposed until its host applied the fix.
- Attacks started quickly. Security companies reported large numbers of attempts to exploit the flaws soon after they became public.
- Older PHP versions are the biggest worry. PHP 8.1 and older no longer get official security fixes, so sites still running them are more exposed to problems like this one.
Why This Matters for South African Small Businesses
For a small business, a hacked website is more than an inconvenience. It can mean your site being taken offline, spam or malicious links added to your pages, your customers being redirected to dodgy websites, or Google showing a warning next to your business in search results. Fixing the damage almost always costs more time and money than preventing it.
Many small business websites in South Africa were built a few years ago and then left alone. They still work and still look fine, so nobody thinks about the server underneath. That’s exactly the kind of site most at risk when something like this happens.
Why You Can’t Just Click “Upgrade”
The obvious fix is to move your website to a newer PHP version, such as PHP 8.3 or 8.4. That’s the right goal, but it isn’t always as simple as flipping a switch.
Each new PHP version drops some older ways of doing things. If your website uses an old theme or a plugin that hasn’t been updated in a while, it may rely on code that newer PHP no longer understands. Upgrade without checking first, and you could end up with:
- A blank white page instead of your website
- A broken layout, contact form or online shop
- An error message where your homepage should be
That’s why a PHP upgrade should be treated as a small project, not a quick click. The safe approach is to:
- Take a full backup of the website and database.
- Update WordPress, the theme and all plugins to their latest versions first.
- Replace any plugins or themes that are no longer supported by their developers.
- Test the site on the newer PHP version, ideally on a staging (test) copy, before switching the live site over.
- Check the important pages, such as your contact form, bookings and checkout, after the switch.
Another Date to Note: 31 December 2026
Even apart from this scare, now is a good time to check your PHP version. According to the official PHP website, PHP 8.2 stops getting security fixes on 31 December 2026. PHP 8.3 is supported until the end of 2027, PHP 8.4 until the end of 2028, and PHP 8.5 until the end of 2029. If your site is on PHP 8.2 or older, plan an upgrade in the next few weeks rather than waiting for the next emergency.
How to Check Your Website’s PHP Version
If you can log in to your WordPress dashboard, go to Tools > Site Health > Info and open the Server section. Your PHP version is listed there. You can also find it in your hosting control panel, or simply ask your host or web developer.
While you’re asking, it’s worth checking:
- Has the 21 October PHP security fix been applied to my server?
- Which PHP version is my website running, and when does its support end?
- Who is responsible for keeping my website and server updated?
If you’re not sure of the answers, that’s a sign your website could do with some attention.
Looking After the Engine, Not Just the Paintwork
Your website is often the first impression a customer gets of your business, so it makes sense to keep it secure as well as good-looking. Regular website maintenance, with updates, backups and a careful plan for PHP upgrades, means news like this becomes something your web team handles quietly in the background, not something you have to worry about.
For more detail, you can read Codeable’s guide for WordPress site owners and the official list of supported PHP versions.
Not sure which PHP version your website is running, or worried an upgrade might break something? Get in touch with 1iDesigns, and we’ll check your site and help you upgrade safely.
