Photo by Priscilla Du Preez 🇨🇦 on Unsplash
There is a good chance your business website runs PHP. Not because you chose it, not because your IT person told you about it, but because PHP quietly powers a very large share of the internet. WordPress alone runs on it, and WordPress powers a significant proportion of UK small business websites. So when a major government security agency issues an advisory telling organisations to patch PHP vulnerabilities without delay, that is not a message aimed only at hospitals or government departments. It reaches right into the inbox of a ten-person accountancy firm running a WordPress site, a boutique retailer using a PHP-based e-commerce platform, and a professional services business whose contact forms quietly process data through it every day.
What PHP actually is, in plain terms
PHP is a programming language that runs on web servers. It handles the parts of a website that do things: processing a form submission, checking a login, pulling content from a database, generating a page dynamically. If your website does anything beyond showing a static page of text and images, there is a reasonable chance PHP is involved somewhere, even if it is invisible to you and your visitors. That invisibility is exactly the problem. Because it sits behind the scenes, it is easy to forget that it is software, software that needs to be kept up to date, and software that attackers specifically look for when they want to find a way in.
What the advisory actually says
The advisory calls out specific PHP vulnerabilities and asks organisations to apply available patches immediately, with particular urgency for any systems that face the internet directly. That phrase, internet-facing systems, is worth sitting with for a moment. It does not mean only large data centres or enterprise networks. Your company website is an internet-facing system. Your customer portal is an internet-facing system. Any web-based tool your staff use through a browser, any login page, any online booking or payment page - these all qualify. The logic behind prioritising them is simple: an attacker scanning the internet for vulnerable PHP installations does not need to target you specifically. They run automated tools that probe millions of addresses simultaneously, and if your server responds with a vulnerable version of PHP, you have just appeared on their list without them ever having heard of your business.
Why patching feels harder than it should for small businesses
For a larger organisation with a dedicated IT team, applying a PHP patch is a standard task on a standard checklist. For most small businesses, the picture is messier. The website was built by an agency a few years ago. Hosting is handled by whoever was cheapest at the time. Nobody is quite sure who is responsible for keeping the server software up to date, and nobody has checked recently whether it actually is. This is not a criticism. It is simply the reality of running a small business, where infrastructure decisions get made once and then quietly forgotten. The problem is that attackers know this. They know that small business websites are more likely to be running outdated software than enterprise ones, and they factor that in when choosing where to probe.
We have written before about how AI is shortening the window between a flaw being discovered and it being actively exploited. That context matters here. The time between a PHP vulnerability being made public and attackers trying to use it is getting shorter. Waiting until your next quarterly review to check on patches is no longer a reasonable approach for anything that sits on the open internet.
Three practical things to check this week
You do not need to become a PHP expert to act on this. You do need to know who is responsible for keeping your web infrastructure patched, and whether they are actually doing it.
- Ask your hosting provider or web agency directly. Send them a short message asking what PHP version your website is running and whether it is receiving security updates. A good provider will answer this quickly. A vague or defensive response is itself useful information about whether they are on top of it.
- Check whether your PHP version is still supported. PHP versions reach their end of life on a published schedule, meaning they stop receiving security fixes entirely. Running an end-of-life version is not just a risk, it is a gap that cannot be closed by patching because no patches are being issued. Your hosting provider should know this and should not be running unsupported versions on your behalf.
- Map out your internet-facing systems. Website, customer portal, booking system, payment page, remote access tools. Make a list. Each one is a surface that needs someone accountable for keeping it current. If you are not sure who that is for each item, that is the first thing to resolve.
If you want a structured way to understand the full picture of what is exposed and what needs attention, vulnerability scanning gives you a clear baseline rather than relying on guesswork. Pairing that with automated patch management means you have a repeatable process rather than a one-off check that gets forgotten again in six months.
The broader pattern worth noticing
This advisory is not an isolated event. It reflects a pattern that has been building for some time: attackers are moving faster, patching windows are narrowing, and the infrastructure that small businesses rely on is just as much in scope as the enterprise targets that make the headlines. The businesses that come through these incidents well are not necessarily the ones with the biggest security budgets. They are the ones that know what they are running, know who is responsible for keeping it updated, and have a process that means patches happen without requiring someone to remember to chase them.
If you are not confident you have that in place, this advisory is a good prompt to find out. Understanding your vulnerability exposure is a reasonable place to start, and if you want a conversation about what a practical patching process looks like for a business your size, get in touch and we can walk through it with you.