Your website appears to be functioning normally. But is its technical environment up to date? The October 21 security alert serves as a reminder that a website can remain accessible even while being vulnerable. For businesses, the stakes are high: protecting their data, maintaining their sales, and ensuring the continuity of their services.
PHP Vulnerability: What Happened?
On October 21, 2026, two critical security vulnerabilities in PHP triggered an international alert. PHP is a technology that powers many websites and applications behind the scenes: it is used, in particular, to process forms, orders, and logins to customer portals.
Rated 9.2/10 in severity, these vulnerabilities could allow a hacker, under certain conditions, to execute their own commands on the server hosting a website, without needing a username or password. The potential consequences are significant: unauthorized access to data, website tampering, or service disruption. European cybersecurity authorities, notably the Belgian Cybersecurity Center (CCB), have therefore called on affected organizations to take immediate action.
In response to the premature circulation of information about these vulnerabilities, the PHP team moved up the release of the patches to October 21. These updates fix the vulnerabilities, but they must still be deployed in each affected environment to protect it.
Which sites are affected?
Any showcase website, e-commerce site, or web service running on an unpatched version of PHP is potentially affected. WordPress, WooCommerce, Drupal, PrestaShop, Magento, Joomla… These tools, among others, rely on PHP. Custom applications, customer portals, and business tools may also use this technology.
You should verify which version of PHP your hosting provider is actually using and whether the patch is installed. The patched versions released on October 21 are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. For older branches, some providers offer specific patches; their availability must be confirmed with the relevant provider.
An up-to-date WordPress installation is therefore not sufficient to fix this vulnerability. The problem lies in PHP, at the server level. Even if your hosting is managed by a provider, you must verify that the fix has been applied.
What can you do to protect your website?
The priority is to have your environment checked and apply the appropriate patch. If an immediate fix is not possible, authorities recommend considering a temporary restriction on access to the affected applications.
A controlled response involves several steps:
- Identify the affected environments, including legacy sites and test versions accessible online.
- Prepare the update, including a backup and a compatibility check of the site, its extensions, and its features.
- Apply the patch and restart the affected services, then confirm that the patched version is actually in use.
- Verify the site’s functionality: forms, orders, payments, logins, and interactions with your business systems. Supplement these tests by checking for any suspicious activity.
This alert also underscores the importance of regular maintenance: understanding your technical environment, keeping up with updates, and knowing who to contact when an emergency arises.
Surround yourself with the right experts so you can take action at the right time
When a critical vulnerability is reported, it is essential to quickly identify the affected sites, assess the necessary actions, and deploy patches while ensuring the site continues to function properly. This is where the value of a partner who understands your technical environment and monitors it comes into play.
At DJM Digital, our technical teams sprang into action as soon as we received the official alert from the Belgian Cybersecurity Center (CCB). We identified the affected sites within the environments we support and implemented the necessary patches. That very same day, our clients’ sites affected by this issue were protected against both vulnerabilities, without any action required on their part.
This responsiveness is based on our ongoing monitoring, maintenance, and in-depth knowledge of the websites we support. For your business, this means having a single point of contact who can explain the situation, handle the technical actions, and keep you informed.
Not sure if your website is protected? Our experts are here to help you check your environment, update PHP, and provide ongoing technical support for your website.
Curious and creative, she loves to dive deep into brands to uncover their true essence — through words, visuals, and bold ideas. For her, great content is the one that makes people react, think, or smile.
