PHP's emergency patch: what to ask your web host

On October 21, 2026, the PHP project put out an urgent security notice. New versions fix two critical flaws that can let a stranger run code on a web server without logging in. If your site runs on PHP, ask your host this week if it is patched. If they take the site down to do it, ask for a 503 page.

What the PHP notice says

The notice is on php.net. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both flaws. The PHP team writes that "All PHP users are strongly encouraged to update immediately."

It says every PHP install that serves web pages is at risk. That covers the usual setups, like PHP-FPM, Apache with mod_php, and LiteSpeed. The team rates the risk highest on Apache with mod_php, where it has shown a working attack.

Old versions are the weak spot. PHP 8.1 and older no longer get updates from the PHP project. Some Linux vendors patch old versions on their own, so the notice says to ask your vendor. The release notes also say PHP 8.2 gets no security fixes after December 31, 2026.

There is no full workaround. The release notes put it plainly: "updating is the only safe choice."

Some sites went offline

Search Engine Roundtable wrote that most sites can patch without downtime. Many others are going offline until the patch is in, just to be safe. It quotes Reuters: "Several government, school and hospital websites in Europe were taken offline on Wednesday".

What Google says about downtime

Google's John Mueller posted on Bluesky the same day. His advice was for anyone taking PHP sites down to patch them. He wrote that they should "use HTTP 503 instead of letting responses time out / 404 / 500". He added that this can be done outside of PHP, with DNS, or at a CDN.

A 503 is a status code a server sends back. Google's older post on planned downtime says it tells search engines the downtime is temporary. It also warns that a 503 left up too long can look like the site is gone for good. Then pages can drop out of Google. Google's guide to pausing a site says a 503 page fits when you have to shut the site for 1 to 2 days. It also says not to send a 503 for the robots.txt file, because that blocks all crawling.

What we don't know

The PHP notice does not say if attackers are using the flaws on real sites yet. Nobody has said which hosts are done patching. Your host can tell you where your site stands.

What I would ask your host

You don't need to know what PHP version your site runs. The host knows. I would send one short message today.

Ask which PHP version the site runs. Ask if it is on one of the fixed versions above, or if their vendor has patched it. If not, ask when. If the answer is 8.1 or older, ask what the plan is to move to a version that still gets fixes.

Then ask one more thing. If they take the site offline to patch it, will it show a 503 page instead of a timeout or an error?

What to do next

Some owners can't send that message. They don't know who hosts the site, or they never got the login. That is the gap to close. Get Seen is how Gman Creations builds a website and its search basics. At the end you get the access and a handoff that explains what was set up. It does not promise rankings. Book a discovery call when you want a human look at what you have: cal.com/shohgman/discovery.

If your site went dark tonight, would you know who to call?

FAQ

Which PHP versions fix the flaws?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project released them on October 21, 2026.

My host runs the server. Do I need to do anything?

Ask them to confirm the update is done. The PHP notice says Linux vendors got the patches in advance, so a host that uses those packages may already have it. A short yes in writing is enough.

Should I take my site offline?

Not by default. Search Engine Roundtable says most sites can patch without downtime. If your host does take it down, John Mueller says to use a 503.

How long can a site show a 503?

Google's guide says a 503 page fits for 1 to 2 days. Its older post warns that a 503 left up too long can get pages dropped from Google.