October 22, 2026 · AI news

The NSA says patch PHP now: what to check on your website

The NSA warned of two serious holes in PHP, which about 70% of websites use. Here is what it means for a small business and what to ask your web host.

Work for business owners · by Orion Jones

The U.S. National Security Agency warned on October 21 about two serious holes in PHP, the software behind about 70% of websites, and said a site that cannot be patched right away should come offline until it can. Here is what that means if you own a website, in plain words.

What happened

The NSA said the two critical holes can let attackers reach a server's files or the database a web app uses. They have been in every PHP version since version 5, released in 2004. The PHP Foundation has issued patches. OpenAI says researchers found the flaws before attackers did, and there are no reports of them being used (TechCrunch, October 21).

PHP is not something most owners ever see, but a lot of the web is built on it. The first figure shows how much.

What it means for a small business

If your website runs on PHP, or on WordPress, which runs on PHP, it may be affected, even though nobody on your team wrote any of it. The fix is not something you click in your browser. It happens on the server that hosts your site, which is usually your web host's or your developer's job.

What to do

Ask whoever hosts or builds your site three things today. The figure lists them with what the NSA and the PHP Foundation said.

• Which PHP version is the site on?
• Has the patch been applied?
• If it cannot be applied today, what is the plan, and does the site go offline until then?

Taking a site offline is a real cost, so it is worth knowing the answers before you need them. This is a summary of one news story, not security advice for your particular setup.

The full issue, with every source, is in today's AI Brief. If you would like someone to check your website's setup and keep it patched, book a call below.