29 Oct A Critical PHP Flaw Hit the Internet Last Week. Here Is What Happened to Our Clients: Nothing
Last week two critical security holes in PHP, the software that runs most of the websites on earth, were patched after attackers had already started using them. Our clients’ sites were patched the same day, and our AI monitoring checked every one of them file by file to confirm nothing got in. This is the part of website hosting nobody talks about until something goes wrong, so here is what happened and what it means for you.
What Happened
PHP is the worker behind the counter of most websites. You ask for a page, PHP builds it, clears the counter and waits for the next request. Two flaws that had been sitting in PHP for years broke that cleanup step.
The first one is a memory overload. Send PHP a request so big it runs out of memory, and it panics and cleans up with scrambled notes. The second one is leftover mess. PHP keeps scraps from an earlier request instead of throwing them away. A hacker can slip their own command into that mess, and PHP runs it as if it were a normal instruction.
That is what security people call remote code execution. It means a stranger can take control of the server without a password or a login. Researchers nicknamed the pair “php2shell.”
The PHP project released emergency fixes on October 21. Attacks had already started four days earlier. By October 26 the U.S. Cybersecurity and Infrastructure Security Agency had added both flaws to its list of threats being used in the real world.
If your site runs WordPress, it runs PHP. If your site is on an older version of PHP, there is no fix coming at all. You have to move.
Attackers Do Not Want Your Website. They Want Your Address.
The people behind these attacks are not interested in your plumbing company or your law office. They want your domain and your server space.
Once they are in, they create fake user accounts and quietly drop their own files onto your server under your web address. Those files host spam, scams and content you would never want your name next to.
Then Google finds it. When Google flags those pages, it can block your entire domain from search results for at least 30 days. If another incident happens on day 28, the clock starts over. Chrome can also show visitors a red warning screen before they reach your homepage.
Your phone number still works. People can still type in your address. But anyone searching for what you do will not find you, and the traffic you spent years building drops off a cliff.
What We Did the Same Day
We do not treat security news as something to write about later. We treat it as a work order.
The day the patch came out we applied it across every client site we host. Then we did something our hosting provider does not do. Our AI agents went through all 70 websites on our server and reviewed every file and every user account in every database to confirm nothing had been touched. That audit took about 30 minutes. A year ago it would have taken days of manual work.
Our hosting provider watches access logs. Attackers know how to get around access logs. That is why we built our own monitoring layer six months ago, and it is why our agents were watching every site during the days between the first attacks and the official patch.
No client asked for this. No client got a bill for it.
The $5,000 Lesson
Earlier this year one of our clients moved their site to a big-name host to save a few dollars a month. A plugin on the site went out of date. When they called the host for help, the answer was that the host only provides hosting, and their developer quoted $5,000 to rebuild the whole site.
We fixed the plugin for free. The client asked to move back.
That is the real difference between hosting and managed hosting. One gives you a server. The other gives you someone who is responsible when things break.
What $125 a Month Actually Buys
Our hosting is $125 a month. Think of it as insurance for your website.
You get a patched and monitored server. You get AI agents reviewing your files and users, not just your logs. And you get our agreement that if your site goes down, we rebuild it. A full rebuild can cost thousands. Thirty days invisible on Google can cost far more than that.
It is also usually the first step toward growth. Cowtown came to us for a rebuild and nothing else, and their business grew dramatically. Absolute Numbers, an accounting firm, did a rebuild plus hosting and landed the exact kind of client they had been hoping for, a brewery in the owner’s hometown. It was the biggest lead they had ever received.
Three Things to Check on Your Site This Week
- Ask your host what PHP version you are on. If the answer is 8.1 or lower, you are running software that no longer gets security fixes.
- Look at your WordPress users. Log in and check for accounts you do not recognize, especially administrators. New users you did not create are the first sign of a problem.
- Search your own domain on Google. Type
site:yourdomain.comand scroll. Pages you never wrote, in languages you do not speak, mean someone else is using your address.
If you would rather have it done for you, we will check your site for free. Call us at (817) 431-9861 or send us your web address and we will tell you what we find.
Your website is software, and software needs someone watching it. Make sure someone actually is.
Sources: CISA, “Critical Vulnerabilities in PHP Require Immediate Patching,” October 21, 2026 (cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching); PHP advisories for CVE-2026-109618 and CVE-2026-109619; Rapid7 and Unit 42 threat briefs, October 2026.