Back Office BeatSubscribe

Published by J9 Systems. What's new in business tech, and what it means for yours.

From the brief of Thursday, October 29, 2026 · No. 16

From the daily brief · AI

PHP patched two critical bugs on Oct. 21: confirm your website host has installed the fix

If your website or booking form runs on WordPress, it runs on PHP. One email to your host settles whether the Oct. 21 security fix is installed.

By Carter Josephson · · 1 min read

What happened

On Oct. 21, 2026 the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical bugs (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on a server without logging in. The project says there are no complete workarounds and updating is the only safe choice.

What it means for a 10-to-50-person business

PHP is the language under WordPress and most shared web hosting. If your website, quote form or client portal runs on WordPress, it runs on PHP. Take a 15-person plumbing company with a WordPress site on a managed host at about $30 a month. Most managed hosts push PHP updates themselves, so the fix is probably in and the owner needs one email to confirm the date. If the site sits on an old plan or a server a former agency set up, nobody may be applying updates. A compromised site can mean a hijacked request form, spam sent from your domain, or a site that goes dark. Care if you own or pay someone to run your site. Mostly ignore it if you use a hosted site builder where the vendor runs the servers.

What to do
Ask your vendor

This week, email whoever hosts or maintains your website and ask for the PHP version running on your server and the date it was updated. You want 8.5.12, 8.4.27 or a later release of 8.3 or 8.2, installed on or after Oct. 21.

What it costs
What it costs
Email to host or agency asking for PHP version and patch date, at $50/hr
15 min (≈ $13)
Agency time if a PHP update is needed, assume 2 hrs at $100/hr
$200
Plugin or theme fixes after a PHP upgrade, assume 1–3 hrs at $100/hr
$100–$300
Doing nothing
$0 now; your site stays exposed to bugs TechCrunch reports are being exploited, and you risk downtime if your host pulls an unpatched site offline
Sources
php.net (primary) · TechCrunch Equity: Wiz CTO on PHP2Shell

Questions owners ask

How do I know if my website runs on PHP?

If it is built on WordPress, it does. Otherwise ask your host or check the hosting control panel, which usually shows the PHP version.

Do I need to do anything about my field-service or accounting software?

Cloud tools are run on the vendor's own servers, so patching them is the vendor's job. Your direct exposure is the website you own or pay someone to host.

What should I ask my web agency exactly?

Ask which PHP version your site runs, whether it was updated after last week's critical bug fixes, the date of that update, and whether anyone is responsible for future PHP updates.

Three to five of these, every weekday morning.

Related