Recent PHP Security Vulnerabilities: What You Need to Know

You may have seen recent news about security weaknesses found in PHP. We want to explain what this means in plain terms, confirm where Orbits IT stands, and suggest a simple next step for you.

PHP is a very common programming language that powers a large share of websites and web applications, including many built on platforms such as WordPress, Joomla and Drupal, as well as online shops, customer portals and booking systems.

Over the past few months, the team that maintains PHP has released several rounds of security fixes, most recently in late September 2026. If left unpatched, the issues they fix could allow an attacker to:

• Crash a website or make it unavailable (a “denial of service”)
• In some cases, run their own code on the web server
• In specific setups, interfere with a website’s database or read information they shouldn’t see

Some of these issues only affect websites that use particular PHP features, so not every PHP website is at the same level of risk. However, the safest course for any website running PHP is to be on the latest patched version.

No. We have reviewed the services we provide to you, and none of them are affected by these vulnerabilities. You do not need to take any action in relation to the services Orbits IT provides.

Many businesses use websites or online systems that are hosted, built or managed by other companies, such as a web design agency, hosting provider or software supplier. As these are outside the services Orbits IT provides, we recommend that you contact those providers directly and ask them to confirm:

1. Whether your website or system uses PHP.
2. Whether it has been updated to the latest security release (as of late September 2026, these are PHP 8.2.34, 8.3.35, 8.4.26 and 8.5.11 or later, or the equivalent patched packages from their operating system vendor).
3. If not, when the update will be applied.

It is also worth asking whether your site runs an older, unsupported version of PHP (for example PHP 7.x or 8.0/8.1), as these may no longer receive regular security fixes and should be upgraded.

If you are unsure who manages a particular website or system, or you would like help understanding a response from a third-party provider, please get in touch and we will be happy to advise.