A major security warning has been issued over serious weaknesses in PHP, a programming language used to run millions of websites around the world. On 21 October 2026, PHP developers released emergency updates to fix two critical security flaws. The warning led some organisations to take websites offline temporarily while they worked to protect their systems. (Reuters)
What is PHP, and what does hacking mean?
PHP is software that helps websites work behind the scenes. It is used by many online shops, business websites, blogs and websites built with WordPress.
Think of a website as a house. PHP is part of the machinery that keeps it running. If that machinery has a weakness, a criminal might find a way to break in without permission.
The latest security flaws are particularly serious because, under certain conditions, they could allow hackers to send a request over the internet and make a vulnerable server run harmful instructions, without needing a password. This could put private information, website content and connected systems at risk. It does not mean every PHP website has been hacked, but it does mean affected systems need urgent attention. (PHP Foundation)
What should ordinary people do?
If you own or manage a website, contact your website developer or hosting company and ask whether your site uses PHP and whether the latest security updates have been installed. The official PHP team has released fixes, so updating is the main protection. If you cannot update immediately, ask your provider about temporarily restricting access to the affected system.
If you are simply browsing the internet, there is no need to panic. Keep your devices and browsers updated, use unique passwords, turn on two-step verification where available, and be cautious of unexpected emails asking you to click links or share personal details.
If you run a small business, make regular backups and ensure your website provider monitors security problems.
The bottom line
PHP is not a hacking tool. It is a widely used technology that, like any software, can contain weaknesses. The important lesson is to keep systems updated, take warnings seriously and seek help from your hosting provider when necessary. A few sensible precautions can make a real difference in protecting your website and personal information.