22 October 2026 | Website Security
It’s been a busy couple of days for our technical team at Resolve Beyond.
A major PHP security update has been released, and we’ve been working through the updates across our managed servers.
If you own a website, you might have seen the news and wondered what it means for you.
So, we thought we’d explain what’s happened, what you need to check and who you should contact.
What’s happened with PHP?
On 21 October 2026, PHP released emergency fixes for two serious security issues.
PHP is used by millions of websites, including WordPress, WooCommerce, Magento, Laravel and many custom-built systems.
The issues, known as PHP2Shell (remote code execution in PHP core), could allow hackers to access servers without permission.
Both have a severity rating of 9.2 out of 10, so they’re certainly worth taking seriously.
However, this doesn’t mean someone has accessed your website.
It simply means that if your server uses an affected PHP version, you need to make sure it’s updated.
You can find more details in the official PHP security announcements.
Does this affect your website?
If your website uses PHP, it’s worth checking whether it needs updating.
Some common platforms include:
- WordPress
- WooCommerce
- Magento / Adobe Commerce
- Laravel
- Custom PHP websites and business systems
What about Shopify?
Shopify looks after its own hosting and security updates. So, if you have a standard Shopify store, you don’t need to arrange this PHP update yourself.
However, if you have any custom systems or integrations hosted elsewhere, those may still need checking.
Not sure what your website is built with? Your developer or hosting provider should be able to tell you.
What should you do next?
First, find out who looks after your website and hosting.
If you have a maintenance provider, ask whether they’ve checked the latest PHP security update.
Otherwise, contact your hosting company directly.
There are a few other things worth checking too.
1. Check your PHP version
The PHP team has released security fixes for versions 8.2, 8.3, 8.4 and 8.5.
The updated versions are:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
If your website uses an older version, it may need a larger upgrade.
For WordPress websites, you can usually find your PHP version under Tools → Site Health → Info → Server.
There’s also a helpful WordPress Site Health guide if you’re unsure where to look.
2. Find out who handles your updates
This is something that’s easily missed.
Just because you pay for website hosting doesn’t always mean your provider handles every update.
Some companies take care of everything for you. Others leave certain updates to you or your developer.
So, it’s worth checking what’s included in your current agreement.
3. Make sure your website will still work
Most routine security patches are straightforward.
However, a major PHP upgrade can sometimes cause problems with older plugins, extensions or custom features.
For that reason, we’d recommend having someone check your website before making significant changes.
Once the update is complete, it’s also worth testing your key features. This is especially important if customers place orders, make bookings or log in to your website.
4. Check your backups
Before making any major updates, make sure you have a recent website backup.
That way, you have a recovery option if something unexpected happens.
It’s also worth asking your provider to check for unusual activity. After all, a website can appear to work perfectly well while still having security issues.
What if you’re running an older PHP version?
If your website uses PHP 8.1 or earlier, you’ll need to look at your upgrade options.
These versions no longer receive official security patches from PHP, although some server providers may offer their own fixes.
Because of this, you should ask your developer or hosting provider to check what’s needed.
For some websites, upgrading will be simple. Others may need extra work to make sure everything still runs correctly.
Either way, it’s not something we’d recommend putting off.
What have we been doing at Resolve Beyond?
Our technical team started reviewing the security information on 21 October, as the initial updates became available.
From there, we continued monitoring our websites and servers while keeping an eye on further guidance.
Following an overnight notification from DigitalOcean, our hosting provider, we started applying the relevant updates.
We prioritised the affected websites and checked them throughout the process.
So far, we’ve carried out the work without any website downtime.
That’s the outcome we were hoping for, especially when so many of our clients rely on their websites and systems every day.
Of course, no website can ever be completely risk-free. But keeping up with security updates is one of the ways we can help reduce those risks.
It’s also a good reminder of how much happens behind the scenes to keep websites running smoothly.
Do you have website maintenance in place?
This situation highlights something we often discuss with clients.
Website maintenance isn’t just about fixing things when they stop working.
It’s also about keeping software updated, monitoring websites and checking for issues before they become bigger problems.
If you don’t have a maintenance plan, now is a good time to find out what support you actually receive. You can find out more about our website support and maintenance services and how we help businesses keep their websites updated, secure and running smoothly.
For example, who checks for security updates? Who carries out urgent work? And who would you contact if something needed attention?
You might already have everything covered. However, if you’re unsure, it’s worth finding out now.
You can also read more about our critical support services.
Not sure if your website needs updating?
If you’ve received a PHP security notification and don’t know what to do, please don’t ignore it.
Start by contacting your hosting provider or website developer. They should be able to tell you whether any updates are needed.
And if you don’t have anyone looking after your website, we’re happy to help.
At Resolve Beyond, we work with WordPress, Magento and custom-built websites and applications.
We can review your setup, advise on any updates and talk you through your options.
You don’t need to be an existing client to get in touch.
We’d much rather help you check things now than see you dealing with a bigger problem later.
Get in touch with Resolve Beyond
Email: hello@resolvebeyond.co.uk
Telephone: 01429 555088
