On October 21, 2026, important security updates were released by the Canadian Centre for Cyber Security to address two critical vulnerabilities in PHP, a technology used to power millions of websites.
Think of PHP as part of the machinery that keeps your website running. Your customers don’t see it, and you probably never need to interact with it directly. But just like the software on your computer, it needs regular updates to stay secure. Here’s what Canadian businesses need to know.
According to W3Techs, PHP is used by approximately 69% of websites whose server-side programming language can be identified, including websites built on popular platforms such as WordPress, Drupal, and Joomla.
The vulnerabilities have each received a critical severity rating of 9.2 out of 10. If exploited, they could allow cybercriminals to remotely execute malicious code on vulnerable servers without requiring a username or password, potentially compromising business systems and sensitive information.
The scale of the threat has prompted an extraordinary response. Government websites in several European countries have been temporarily taken offline as a precaution, while organizations worldwide have rushed to deploy security updates. On October 22, Reuters reported that Cloudflare had observed millions of attempted attacks within hours of the vulnerabilities being disclosed.
Canada’s own Centre for Cyber Security has issued an urgent advisory, warning that “Internet-facing PHP servers and applications are at heightened risk.”
Security patches were released on October 21, but that doesn’t necessarily mean every website is protected.
For Canadian businesses, particularly those relying on third-party website hosting providers, there are two important questions to ask: Has your hosting provider applied the necessary security updates? And is your website running a current, supported version of PHP?
Your hosting provider will likely handle the patch but don’t assume it’s been done
If your website is hosted or maintained by an outside company, there’s a good chance they’re already aware of this issue.
Many reputable hosting providers actively monitor security announcements and install important updates as part of their services.
However, different providers offer different levels of support. Not every hosting agreement includes the same security responsibilities.
That’s why it’s worth taking a few minutes to confirm.
Our recommendation is simple: Contact your hosting provider and confirm that the latest security patches have been applied.
Your provider should be able to tell you whether your website is affected and, if necessary, what steps are being taken to protect it.
For additional peace of mind, consider asking:
- What version of PHP is our website currently using?
- Has the latest PHP security patch been installed?
- If we’re using an older version, is there a plan to upgrade?
- Who is responsible for ongoing website security updates?
If your provider confirms that your website is running an outdated version of PHP, ask what protections are in place and how they plan to address the issue.
Don’t assume that because someone else manages your website, the necessary security measures have been taken.
Running an older version of PHP? You could still be exposed.
According to the official PHP security announcement, security patches were released for PHP 8.2 and newer on October 21, 2026. However, simply running one of these versions doesn’t automatically mean your website is protected. The appropriate security update still needs to be installed.
Businesses running PHP 8.1 or older should pay particular attention as they are no longer officially supported.
These older versions no longer receive official PHP security updates, meaning websites using them may remain at risk unless their hosting provider has applied a separate, verified security fix.
Even businesses using PHP 8.2 should be planning an upgrade, as its security support ends on December 31, 2026.
It’s also important to recognize that simply running a supported version isn’t enough. Your website must be updated to a release containing the latest security fixes.
Businesses should confirm their current PHP version with their hosting provider and arrange an upgrade where necessary.
Three steps every business should take right now
- Contact your hosting provider. Ask whether the critical PHP security patches released on October 21 have been applied and request confirmation that your hosting environment has been checked.
- Check your PHP version. Confirm that your website is running a supported, fully patched version of PHP, ideally PHP 8.4 or 8.5 where compatible. If you’re using PHP 8.1 or earlier, prioritize an upgrade or confirm that your vendor is providing appropriate security fixes.
- Review your website security. Make sure your website software, plugins, themes, and hosting environment are regularly updated. Confirm that appropriate security monitoring and backups are in place.
If your website uses WordPress, you can usually check your PHP version by going to Tools > Site Health > Info > Server in your WordPress dashboard.
Website security shouldn’t be an afterthought
For many businesses, their website is one of their most important customer-facing assets. Yet website hosting and maintenance are often treated as something that can be set up once and largely forgotten.
The latest PHP vulnerabilities are a reminder that cybersecurity extends beyond employee computers, email accounts, and internal networks. Your website and its underlying infrastructure also require ongoing attention.
And while your hosting provider may be responsible for maintaining that infrastructure, it’s important to make sure the necessary security measures are actually being taken.
Not sure whether your business website is protected?
PartnerIT can help you understand your potential cybersecurity exposure, identify outdated software, and determine what steps may be needed to strengthen your protection.
Contact PartnerIT to discuss your website security and broader cybersecurity needs.
