Back Office BeatSubscribe

Published by J9 Systems. What's new in business tech, and what it means for yours.

From the brief of Thursday, October 22, 2026 · No. 11

From the daily brief · AI

PHP 8.5.12 fixes two critical remote-code flaws; ask your web host to confirm Oct. 21

Unpatched PHP servers can be taken over by an unauthenticated visitor. Most small firms only need one email to their host.

By Carter Josephson · · 1 min read

What happened

On Oct. 21 the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws (CVE-2026-109618 and CVE-2026-109619) that let an unauthenticated attacker run code on a server running PHP. The PHP Foundation says full code execution was demonstrated with default settings on Apache with mod_php, and tells everyone who runs PHP to update now.

What it means for a 10-to-50-person business

PHP runs most small-business websites, including every WordPress site. Take an 18-person plumbing company with a WordPress site and a booking form that stores names, addresses and phone numbers. On a managed WordPress host, the patch is likely already applied and costs nothing. If a freelancer built the site in 2019 on its own server and it still runs an older PHP branch, no patch exists for that branch. The fix is an upgrade to a patched version, which can break an old theme or plugin; assume 4 to 10 developer hours. A site on a hosted builder such as Wix or Squarespace has little to do. A self-hosted client portal at an accounting or law firm is urgent. Details are public, so waiting costs more each week.

What to do
Ask your vendor

This week, email your web host or whoever maintains your site and ask them to confirm in writing that every site and portal you own runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and get a date if it does not.

What it costs
What it costs
Email to host or web developer
15 min
Patch on a managed WordPress host
$0, normally included
Upgrade from an unsupported PHP branch (assume 4–10 hrs at $100/hr)
$400–$1,000
Doing nothing
$0 today; an unpatched site can be taken over by anyone who finds it, and a breach of customer data costs far more than the upgrade
Sources
thephp.foundation (primary) · TechCrunch: PHP Armageddon: OpenAI, Google's Wiz find ancient holes · OpenAI: Coordinated disclosure of critical vulnerabilities · Wiz: PHP2Shell remote code execution in PHP

Questions owners ask

We use WordPress. Is WordPress itself the problem?

No. WordPress says the flaw is in PHP, the language it runs on, not in WordPress. Updating plugins will not fix it. The server's PHP version has to be patched, which is usually your host's job.

Our site is on Squarespace or Wix. Do we need to do anything?

On hosted site builders you do not manage the server, so server software updates are the provider's responsibility. No action is needed beyond watching for any notice from them.

Has anyone been hacked through this yet?

OpenAI says researchers found the flaws before attackers did, and there were no reports of attacks at disclosure. Now that the details are public, that can change quickly.

Three to five of these, every weekday morning.

Related