Critical PHP Vulnerabilities: Why Websites Are at Risk and Could HTML Be an Alternative?
In October 2026, two critical vulnerabilities were discovered in PHP, one of the most widely used technologies in web development. The flaws could allow attackers to remotely run commands on vulnerable servers and interfere with their operation. Governments and businesses have been rushing to update their software, while some websites have been temporarily taken offline to prevent potential attacks.
The scale of the problem reflects how widely PHP is used. According to W3Techs, cited by Reuters in its report on the PHP vulnerabilities, PHP is used by nearly 70% of websites for which the server-side programming language is known. WordPress, a content management system built on PHP, powers approximately 40% of all websites.
For websites that do not require complex functionality, switching to static HTML could be a viable long-term solution. However, website owners should first assess their security risks and take steps to protect their data.
PHP is an open-source programming language used to build websites and web applications. It runs on the server, processing requests, handling data, and generating the pages users see in their browsers. PHP powers features such as user accounts, contact forms, and online shopping carts.
On October 21, 2026, the PHP team released fixes for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both received a severity score of 9.2 out of 10 under CVSS 4.0. Under certain conditions, the flaws could allow attackers to remotely run commands on a server without the owner's permission. This creates a risk of data theft, website defacement, and loss of control over the server.
Researchers at cybersecurity company Calif discovered the PHP vulnerabilities with the help of an OpenAI AI model. The situation became more urgent when information about the flaws appeared on a hacking forum before the patches were scheduled for release. As a result, the PHP team published the fixes earlier than planned.
Given PHP's widespread use, the vulnerabilities have put websites of all sizes at risk. Some government websites in Europe were temporarily taken offline while their operators checked their systems and installed security updates.
Sources: Official PHP release information, Google Cloud, Amazon Web Services.
PHP allows servers to process requests, retrieve data, and generate content based on user actions. Static HTML works differently: pages are prepared in advance, and the server delivers the finished files directly to the browser.
If a website primarily publishes information and does not require complex functionality, it may be possible to convert it to static HTML. This eliminates the need for PHP to generate its pages. Fully removing PHP from a website also eliminates exposure to vulnerabilities specific to PHP, provided the technology is no longer used elsewhere in the site's operation.
This approach may be worth considering for brochure websites, landing pages, corporate websites, portfolios, and other information-focused resources. For more complex projects involving user accounts, shopping carts, or other server-side functionality, switching technologies may require additional development. If removing PHP is impractical or unnecessary, keeping the software up to date and maintaining appropriate security measures remain the priorities.
The first step is to contact the person or company responsible for maintaining your website. This could be an in-house administrator, a developer, or your hosting provider. Find out whether your website uses PHP, whether its installed version is vulnerable, and what steps have already been taken to secure it. Do not assume the issue has been resolved without checking.
- Check Your PHP Version and Install the Fixes
The PHP team released patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Check which version your server is running and make sure the appropriate fix has been installed.
If your website is hosted on a shared hosting service, contact your provider to confirm that the server software has been updated. Updating your content management system (CMS) or its plugins does not replace the need to check your PHP version.
- Back Up Your Website
A backup can help you restore your website if its files or data are damaged or lost. Creating a backup is not enough, though: make sure it can actually be used to restore the site. Store the backup separately from the live website so that it remains available if something goes wrong with the production environment.
- Monitor for Suspicious Activity
Continue monitoring your website even after installing the patches. Watch for unusual changes, suspicious requests, and other signs of unauthorized access. If you suspect your website has been compromised, seek help from a cybersecurity professional.
If you cannot install the fixes promptly, consider temporarily restricting access to the vulnerable website until the issue is resolved. This is also recommended by CERT-EU.
Businesses should also assess whether their websites actually need PHP. For sites that primarily publish information, switching to static HTML may simplify maintenance and eliminate dependence on the technology. For more complex web applications, timely updates, regular backups, and ongoing security monitoring remain essential.
If you want to assess your website's security or protect it against potential threats, Atlasiko's specialists can evaluate your site's current security posture, identify potential issues, and help you choose the right approach to protecting your website.
