Sole Traders and Micro Businesses: A 10-Minute Check for the PHP Vulnerability
If you run a small business with no IT department, you may have seen headlines about websites going offline this week and wondered whether yours is affected. The short answer: if your website runs on WordPress or most other common website platforms, it runs on PHP, and PHP had two serious security flaws fixed in an emergency update on 21 October 2026.
The good news is that checking takes about ten minutes. (If you'd like the full background, including government sites in Europe and Canada switching off as a precaution, read our main article on PHP2Shell and the Cyber Essentials 14-day patching rule.)
Step 1: Work out what your website is built on (2 minutes)
WordPress, Joomla or Drupal? These all run on PHP. Keep reading.
Wix, Squarespace or Shopify? These are fully managed platforms. The provider looks after the servers, so there's nothing for you to update yourself.
Not sure? Check your hosting account or ask whoever built the site.
Step 2: Find your PHP version (5 minutes)
Log in to your hosting control panel (often called cPanel, Plesk or a "site tools" area) and look for a section called PHP version, PHP manager or PHP settings.
You're looking for one of these fixed versions, or newer:
8.5.12
8.4.27
8.3.36
8.2.35
Many large hosting companies moved to protect customers automatically, so you may well find it's already done. If you see 8.1, 8.0, 7.4 or older, you're on a version that may not receive a fix at all. That needs upgrading, and it's worth asking your web designer to check the site still works on a newer version first.
Step 3: If in doubt, email your host (3 minutes)
Copy, paste and send:
Hello, please can you confirm whether my website has been updated to a fixed PHP version following the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) announced on 21 October 2026? Please let me know which version my site is now running and the date the update was applied. Thank you.
Keep the reply. It's useful evidence if you ever apply for Cyber Essentials.
Why speed matters, even for small sites
It's tempting to think nobody would bother attacking a small business website. Unfortunately, attacks like this are automated. Criminals scan the whole internet for vulnerable servers, and security researchers expected mass attacks within minutes of the fix being released. Your site doesn't need to be interesting to be found, it only needs to be unpatched.
Where Cyber Essentials comes in
Cyber Essentials is the UK government-backed scheme that shows customers you've got the basics covered. One of its requirements is that important security updates are installed within 14 days, and that software you can no longer get updates for is removed. That applies to your laptop and phone as well as your website.
Our advice for micro businesses is simple: switch on automatic updates everywhere you can, check anything that can't update itself at least weekly, and act the same day when there's news like this.
The Cyber Essentials benefits for a small business include eligibility for some contracts, reassurance for customers, and a clear checklist for staying safe without becoming an IT expert. If you'd like to know how to get Cyber Essentials and want someone to walk you through it, our Supported service does exactly that. There's more help in our micro organisations resources.
Comments