Startup Playbook: success through failure

PHP Vulnerability: A 24-Hour Plan for Freelancers and Founders Who Look After WordPress Sites

TL;DR: What should freelancers do about the PHP vulnerability?

PHP, the language behind every WordPress site, got an emergency fix for two critical vulnerabilities on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP rated each one 9.2 out of 10. If you build or look after websites for clients, today is a work day: list every client site, check its PHP version, contact each host, back everything up and confirm the update tomorrow. Then send your clients a short, calm message, and turn this into a paid website care plan.
Developing story. Last updated 21 Oct 2026, 15:50 CEST. PHP has released the fix. We will keep updating this article as reports of attacks come in.
Update 21 Oct, 15:50 CEST: PHP has released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its security advisory confirms that both flaws (CVE-2026-109618 and CVE-2026-109619) allow remote code execution without a login, on every PHP setup that serves web requests, with the highest risk on Apache with mod_php. PHP's advice for your client list is short: "There are no complete mitigations, updating is the only safe choice." Sites on PHP 8.1 and older get no official release.
The PHP vulnerability announced on 20 October 2026 turned "PHP" into a Google Trends spike in the US, with a +300% jump overnight. For freelancers, web designers and first-time founders who set up WordPress sites for others, this is the moment your clients find out whether anyone is looking after their website.
Here's what happened, which sites need attention, a 24-hour plan, a message you can send your clients, and how to turn the work into recurring income.

What is the PHP vulnerability, and why is it trending today?

PHP is the programming language that runs on the web server behind WordPress, WooCommerce and many other website systems. On 20 October 2026 the PHP project posted an advance notice of a critical security release: two vulnerabilities, both rated 9.2 on the CVSS v4.0 scale (the standard 0 to 10 score for security flaws), fixed in a release on Wednesday 21 October at 14:00 UTC.
Two things turned it into a trend. First, the details leaked early: BleepingComputer reported that a Hacker News post broke the news before the planned disclosure, and the security firm watchTowr confirmed it. Second, PHP confirms both bugs allow remote code execution without logging in, which means an attacker can run their own code on the server and take over the website.
Security firms don't agree yet on whether attackers are already using the flaws. Sansec reported that Cloudflare saw early attacks on PHP sites on the morning of 21 October, while watchTowr said it had seen no exploitation. Sansec also listed Dutch sites that went offline as a precaution that day, including Tweakers and the Dutch House of Representatives. For a freelancer, that's enough of a signal to treat today as urgent.

Which client websites are affected?

Any client site that runs on PHP depends on this fix. That covers WordPress, WooCommerce, Joomla, Drupal, Magento and PrestaShop, plus many booking, forum and membership tools. Sites on fully hosted builders are a different case, because the platform runs the servers and you never touch PHP there.
The version matters a lot. PHP's advisory lists every version before the fixed releases as affected, so each client site needs one of these:
Client site runsUpdate to
PHP 8.58.5.12
PHP 8.48.4.27
PHP 8.38.3.36
PHP 8.28.2.35
PHP 8.1, 8.0, 7.4A backported package from the host or distribution, then migrate
PHP's supported versions page shows four branches that still get security fixes:
PHP versionStatus on 21 Oct 2026What to tell the client
8.5 and 8.4Active supportUpdate to the fixed release today
8.3 and 8.2Security fixes onlyUpdate today, plan 8.4 or 8.5 next year
8.1 and 8.0End of lifeMove to a supported version this month
7.x and olderEnd of lifeTreat as urgent: migrate or rebuild
Old versions are common. On W3Techs data for PHP 8 from 21 October 2026, 15.2% of PHP 8 sites run 8.1 and 5.8% run 8.0, and PHP confirmed that 8.1 and older get no official release, only minimal source backports for 7.4, 8.0 and 8.1. If you inherited client sites from another freelancer, check those first.

What is the 24-hour plan for freelancers?

  1. Build your client list. Every site you built, host or maintain, with the hosting company and who holds the login. Include staging copies and old campaign pages. Beazley Security also advises checking for PHP bundled inside third-party products.
  2. Check each PHP version. In WordPress, open Tools, Site Health, Info and then Server. In a hosting panel, look for PHP settings. Sort the list: 8.1 and older go to the top.
  3. Back up before you touch anything. Files and database for every site. Store the copies outside the server, in a cloud folder you control. Our list of cloud storage tools for startups has options.
  4. Contact every host. Ask when they install the fixed PHP release. Managed hosts handle it themselves. On a VPS or your own server, you install it the same day the update reaches your system.
  5. Put a firewall in front where you can. Sansec reports that Cloudflare deployed emergency rules for all its customers, free plan included. PHP core developer Gina Peter Banyard told Sansec that patching PHP is the only real fix, so treat a firewall as a stopgap.
  6. Confirm and write it down. The next day, check each site's PHP version, test forms and checkout, and note the date in your client log.
If you run your own servers or build apps on PHP, MeanCEO has a deeper technical take on what tech founders should patch first. If you're a solo founder with just your own small site, the Fe/male Switch Foundation has a simpler no-developer plan for small business websites. Engineering teams whose portals and download pages hold CAD files can follow CADChain's PHP checklist for engineering teams.

What should you tell your clients?

Clients will read scary headlines, so get to them first. Keep it short, calm and specific. Here's a message you can adapt:
Hi [name], PHP, the software that runs on your website's server, released an important security update on 21 October 2026. I'm checking your site [domain] today: I'll take a full backup, confirm the update with your hosting company and test that everything works. You don't need to do anything. I'll send you a short note once it's done.
Clear writing matters here as much as on the site itself, and our tips on website content writing for small businesses apply to client emails too. If you juggle many clients, our guide to freelance project management helps you track who got the update.

How do you turn this into a website care plan?

Days like this show clients the value of ongoing care. Many freelancers build a site, hand it over and never look at it again, and the client only learns about PHP when something breaks. A website care plan is a monthly service where you keep the site updated, backed up and monitored. It's one of the simplest recurring offers for a freelancer or a first-time founder with web skills.
Price it on your time and the number of sites, put the scope in writing, and include a same-day response for security emergencies like this one. Security is also part of how you sell: our post on simple ways to secure your business from any threat covers the basics clients expect. And if you'd rather offer sites with no server to maintain, compare the options in our list of no-code development tools.
Turn your skills into your first startup

The Fe/male Switch startup game takes you from idea to first paying customers in weekly quests, with an AI co-founder and a community of founders.

👉 Start the game

More on this story

FAQ: the PHP vulnerability for freelancers and their clients

Do I need to update WordPress because of the PHP vulnerability?

Updating WordPress is good practice, but it won't fix this. The flaws are in PHP itself, so the server needs the fixed PHP release. Your host installs it, or you do if you manage the server.

Which PHP version fixes the vulnerability?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. Sites on 8.1 or older need a backported package from their host or distribution, then a move to a supported version.

Which PHP versions still get security updates?

PHP 8.2, 8.3, 8.4 and 8.5. Versions 8.1, 8.0, 7.x and older are end of life and no longer get official fixes.

Should I take client sites offline?

For most client sites, a backup plus a same-day update is enough. Sansec lists going offline as one option until the fix is installed and quotes PHP core developer Gina Peter Banyard calling it the most sensible one, so consider it for old sites on unsupported versions. If you do switch a site off, block traffic before it reaches PHP, because WordPress maintenance mode doesn't help; MeanCEO's guide to going offline over the PHP issue has the steps and a customer message.

What is a CVSS score of 9.2?

CVSS is the standard 0 to 10 scale for how dangerous a security flaw is. Anything from 9.0 up is rated critical, the top level.

What is a website care plan?

A monthly service where a freelancer or agency keeps a client's site updated, backed up, monitored and protected, with a plan for emergency fixes like the October 2026 PHP release.

About the Author

Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
2026-10-21 13:51 news