DeskWolf®Let’s talk
Hands typing on a laptop keyboard

SECURITY / BUSINESS

Black October: What the PHP Security Flaws Mean for Your Small Business Website

By Vic Roque · October 2026

If you run a small business or a coaching practice, your website probably isn't something you think about every day. It books calls, takes payments, and collects emails in the background. This month is a good reason to give it five minutes of attention.

Here's the short version. Two critical security flaws were found in PHP, the code behind a huge share of the web, including WordPress, WooCommerce and Magento. Cloudflare's CEO said its network saw millions of attempts to exploit them. The good news: there are no confirmed break-ins, and fixes are out. The job now is to make sure your site has them.

No panic, no jargon. Just what happened and what to do.

What happened

PHP released emergency fixes for two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 (nicknamed "php2shell"). Both are rated Critical. In plain terms, a flaw like this could let an attacker run their own code on a website's server without logging in. That can mean stolen data, a defaced site, or a full takeover.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch immediately, and noted that it had not seen successful exploitation at the time of its alert.

The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions (8.1 and below) no longer get official fixes from PHP, though some hosting providers have built their own patched packages.

How big is this?

Big in attention, quiet in actual damage so far.

  • Cloudflare's CEO said its network saw millions of exploit attempts, and Cloudflare switched on firewall protection for its customers, including free plans.
  • Hunt.io, a threat-research firm, found attack tools aimed at online stores like WooCommerce and Magento, but no confirmed successful attacks. Their read: attackers are trying hard, and the exploit is hard to land on a real site.
  • Major web hosts including GoDaddy, WP Engine, Kinsta and others rolled out emergency fixes. ActiveSet keeps a running tracker of what each host has said publicly.
  • Square told sellers who run their own WooCommerce, Magento, OpenCart or PrestaShop store to check with their host or developer. Stores hosted by Square Online or Weebly were already covered.

So the right takeaway is not "the sky is falling." It's "the door was found, the lock is available, make sure yours is installed."

Is my website affected?

It depends on where your site lives:

  • Hosted website builders (like Square Online or Weebly): the platform handles this for you. Square says no action is needed for stores it hosts.
  • Managed WordPress or shared hosting (GoDaddy, WP Engine, Kinsta, SiteGround and similar): most major hosts say they've applied the fix. Confirm your specific plan is included.
  • VPS or self-managed servers: the update is on you or your developer. Hosts generally don't patch these for you.
  • Not sure? Ask your web person or your host. That one question is the whole first step.

One gotcha: some hosts apply the fix without changing the PHP version number. GoDaddy, for example, says its Web Hosting customers should check the PHP build date instead of the version. Don't assume "old number" means "not patched." Ask.

An open issue to know about

PHP has also disclosed a separate, third flaw, CVE-2026-115560, which GoDaddy reports is not yet patched. PHP plans to fix it in its next routine release. In the meantime, there's a recommended setting change (turning off a feature called session upload progress). Several hosts, including GoDaddy and Hostinger, say their managed servers already have that protection in place. If you run your own server, ask your developer about it.

Scammers love news like this

Here's the part that actually hits most small business owners. Big security headlines bring a wave of fake "urgent" emails and texts: "Your website is at risk, click here to patch," "Your host account will be suspended," and so on.

Don't click. If you're worried, log in to your host or app directly, or call your web person. A real fix never needs you to hand over a password through a random link.

Your business-owner checklist

Print this, forward it, or knock it out over coffee:

  • Ask your web person or host: "Is our site's PHP patched for CVE-2026-109618 and CVE-2026-109619?" Get a yes or no.
  • If you run your own server: update PHP, restart it, and ask about the setting for CVE-2026-115560.
  • Turn on 2FA (two-factor login) for email, bank, socials, payments, and your website admin. Use an authenticator app or passkey, not text messages.
  • Turn it on for the whole team, not just you.
  • Update everything: phone, laptop, browser, apps and website plugins. Turn on auto-updates.
  • Back up your business files and your website, and make sure you know how to restore them.
  • Use a password manager with a unique password for every account.
  • Spot fake alerts. Skip "urgent" links and texts. Log in from the app or site directly.

The bottom line

You don't need to be technical to stay safe here. You need one clear answer from whoever runs your site, and a few good habits on your own accounts. That's it. Real people grinding to keep their business running deserve straight answers, not scare tactics.

Sources

Get the straight version, first

Follow @deskwolf.ai on Instagram for the straight version on tech news that affects your business, without the panic.