InsightsSecurity
Serious security flaws in PHP – is your website affected?
Two serious security vulnerabilities have been discovered in PHP, the technology behind many websites and systems. This has raised concerns, particularly among companies using WordPress, WooCommerce or older web-based solutions.
But just because your website uses PHP does not automatically mean it is vulnerable. What matters is finding out which version you use and whether anything needs fixing.
Not sure if you're affected? We can help.
You do not need to know which PHP version you use or keep track of every technical detail. We will help you work that out.
We can examine your website or system, check whether you're affected by the security vulnerabilities and help you prioritise the right actions.
Just tell us which website or system is involved. We will take it from there.
What has happened?
On 21 October 2026, CERT-SE highlighted two critical security flaws in PHP.
PHP is a programming language used behind many websites, e-commerce solutions and business systems. WordPress and WooCommerce are among the platforms that use it.
Under certain conditions, the security vulnerabilities could allow unauthorised users to run malicious code on a server.
That sounds serious, of course, and it is. But it does not mean that every website using PHP is vulnerable or has been attacked.
Security updates are available. The next step is to check which systems are affected and make sure the right updates are applied.
How do you know if your website is affected?
This depends, among other things, on which version of PHP is used and how the website’s technical environment is set up.
If you use WordPress or WooCommerce, PHP usually runs in the background. Even if WordPress and all plugins are up to date, the server environment itself may need a review.
For older or custom-built systems, the situation can be more complicated. Sometimes there are dependencies that mean an update needs to be planned to avoid affecting other functions.
That is why it makes sense to check the setup before making changes.
How do you know if your website is affected?
This depends, among other things, on which version of PHP is used and how the website’s technical environment is set up.
If you use WordPress or WooCommerce, PHP usually runs in the background. Even if WordPress and all plugins are up to date, the server environment itself may need a review.
For older or custom-built systems, the situation can be more complicated. Sometimes there are dependencies that mean an update needs to be planned to avoid affecting other functions.
That is why it makes sense to check the setup before making changes.
What do you need to do?
The most important thing is not to ignore the problem, but you do not need to start changing things on your own without knowing how the systems fit together.
Start by finding out:
- 1Whether your websites or systems use PHP.
- 2Which PHP versions are in use and whether they are affected by the security vulnerabilities.
- 3Who is responsible for the server environment and updates.
- 4Whether there are older functions or dependencies that need to be taken into account.
CERT-SE recommends updating affected systems promptly and checking for signs of a breach.
If you don't know how to check this, we can help you.
What do you need to do?
The most important thing is not to ignore the problem, but you do not need to start changing things on your own without knowing how the systems fit together.
Start by finding out:
- Whether your websites or systems use PHP.
- Which PHP versions are in use and whether they are affected by the security vulnerabilities.
- Who is responsible for the server environment and updates.
- Whether there are older functions or dependencies that need to be taken into account.
CERT-SE recommends updating affected systems promptly and checking for signs of a breach.
If you don't know how to check this, we can help you.
When a simple update is not so simple
For some websites, installing a security update is enough. For others, an update may affect functions the business relies on.
This is particularly relevant to older websites and custom-built systems where documentation may be missing or the original developer is no longer around.
In that case, you need to understand how the system works before deciding what to do.
At CodeBridge, we work with both modern websites and older systems. We're used to getting to grips with solutions built by others and finding ways forward without causing unnecessary disruption.
When a simple update is not so simple
For some websites, installing a security update is enough. For others, an update may affect functions the business relies on.
This is particularly relevant to older websites and custom-built systems where documentation may be missing or the original developer is no longer around.
In that case, you need to understand how the system works before deciding what to do.
At CodeBridge, we work with both modern websites and older systems. We're used to getting to grips with solutions built by others and finding ways forward without causing unnecessary disruption.
When a simple update is not so simple
For some websites, installing a security update is enough. For others, an update may affect functions the business relies on.
This is particularly relevant to older websites and custom-built systems where documentation may be missing or the original developer is no longer around.
In that case, you need to understand how the system works before deciding what to do.
At CodeBridge, we work with both modern websites and older systems. We're used to getting to grips with solutions built by others and finding ways forward without causing unnecessary disruption.
Reassurance and experience
We help you work out what needs to be done
Are you unsure whether your website or system is affected by the new PHP vulnerabilities?
Get in touch with us. You do not need to have the answers to the technical questions – that is what we are here for.
We help you understand the current situation, identify any risks and work out what the next step should be.
