It’s been a crazy couple of days in the world of web development.

The announcement of two critical security vulnerabilities in PHP, one of the world’s most widely used web development technologies, has made headlines far beyond the usual developer and cybersecurity circles, even reaching mainstream news outlets such as the BBC.

On 21 October 2026, the PHP development team released emergency security updates to address two critical vulnerabilities that could potentially allow attackers to execute malicious code on vulnerable web servers without needing to log in.

Understandably, this has raised concerns for businesses relying on PHP-powered websites, including those built with popular platforms such as WordPress, Drupal, Laravel and Symfony.

But should website owners be worried? Why are we seeing vulnerabilities like these? And what can businesses do to protect themselves?

The AI effect: why are we discovering more vulnerabilities?

Artificial intelligence is changing the world of software development, and cybersecurity is no exception.

One of the most interesting aspects of the recent PHP vulnerabilities is that AI-assisted security research played a role in their discovery.

AI tools are becoming increasingly sophisticated at analysing vast amounts of code, identifying unusual behaviour and uncovering complex security weaknesses that might otherwise take human researchers considerably longer to find.

This is largely a good thing. The quicker vulnerabilities are identified, the quicker developers can work to fix them.

However, there’s another side to the story.

AI is also making software development faster and more accessible than ever. Developers can now generate substantial amounts of code in seconds. While this can be incredibly useful, blindly trusting AI-generated code without proper review or testing risks introducing new security weaknesses into websites and applications.

It doesn’t necessarily mean software is becoming less secure. But it does mean the pace of both software development and security research is changing, and businesses need to keep up.

Should I be worried about my website?

Firstly, don’t panic. The discovery of a security vulnerability doesn’t automatically mean your website has been compromised.

However, it does mean action may be needed, sometimes urgently.

Bear in mind that most modern websites rely on multiple layers of software. There’s the underlying programming language, the content management system (CMS), frameworks, plugins, third-party libraries and hosting infrastructure.

The important question for business owners is therefore less about whether a technology will ever have a vulnerability, and more about whether someone is actively looking after their website when vulnerabilities are discovered.

What can I do to protect my website?

If your website uses PHP, there are three steps worth taking now:

1. Check your PHP version. If you’re unsure what version your website is running, ask your developer or hosting provider.
2. Confirm the latest security updates have been applied. The PHP development team has released fixes for the vulnerabilities, and affected installations should be updated as a priority.
3. Check for any signs of compromise. Ask whoever manages your website whether appropriate security monitoring and checks have been carried out.

It sounds simple, but keeping website software up to date is one of the most important steps businesses can take to reduce their security exposure.

At Proctors, we schedule regular software updates for the websites we manage for our clients, helping ensure that the underlying technologies, frameworks and dependencies remain current and secure.

Why does this matter?

Imagine your website is running PHP 8.3.35 and a new security update requires moving to PHP 8.3.36. That’s generally a relatively straightforward update, subject to the appropriate testing.

Now imagine your website is still running PHP 7.4, an older version that reached its official end of life years ago.

Moving from PHP 7.4 to a modern, supported version can involve significant development work, compatibility changes and testing. Suddenly, something that could have been a relatively simple security update becomes vastly more complex.

By regularly maintaining websites, we help our clients avoid falling so far behind that urgent security updates become difficult, expensive or disruptive.

When the news of the PHP vulnerabilities broke, our team immediately identified the clients with at-risk sites. We then took action outside our regular maintenance schedules to research the issue and configure hot fixes that would offer temporary protection pending an official fix being announced. We monitored the PHP site closely and as soon as the security patches were available, we conducted the updates, tested and released.

Of course, updates aren’t the only piece of the puzzle. Websites also need appropriate security configuration, monitoring, testing, backups and a clear process for responding when something goes wrong.

Does this mean PHP is insecure?

Absolutely not.

PHP has been around for more than 30 years and remains a powerful, established technology behind a huge number of websites and applications.

Like virtually every major programming language or framework, PHP has experienced security vulnerabilities throughout its history. The same is true of JavaScript, Python and many other technologies.

What matters is how those vulnerabilities are discovered, addressed and managed.

At Proctors, we’ve been developing PHP-based websites and applications for many years, using technologies including Drupal, WordPress, Laravel and Symfony.

Are there alternatives to PHP? (And are they ‘better’?)

You might be wondering whether there are alternatives to PHP, and the simple answer is yes.

At Proctors, we use a range of programming languages and content management systems including Next.js, Payload CMS and Webflow so we can recommend what best suits each client’s requirements.

Each has its own advantage but here’s the important thing to remember – moving away from PHP doesn’t mean moving away from security vulnerabilities.

JavaScript frameworks, CMS platforms, third-party packages and managed website services can all experience security issues.

Next.js and Payload applications still require ongoing dependency updates, testing and maintenance. With Webflow, much of the underlying infrastructure and platform security is managed by the provider, although website configuration, integrations and access management remain important responsibilities.

Concerned about your website’s security?

The recent PHP vulnerabilities don’t mean businesses need to abandon PHP or rethink their entire website. But they do highlight the importance of having the right technical support in place when security issues arise.

If you’re concerned about your website’s security or unsure whether your current technology is right for your business, get in touch at [email protected] to see how we can help.

About Proctor + Stevenson

From tackling your marketing painpoints to delivering global brand strategies, Proctor + Stevenson is the B2B marketing specialist that says YES to your commercial challenges.