Photo by Ilya Pavlov on Unsplash
Most small business owners have never typed a line of PHP in their lives. Plenty have never even heard the word. But if your business has a website, there is a strong chance PHP is running quietly underneath it right now, and that matters more this week than it did last month.
PHP is the programming language that powers a huge proportion of the web. WordPress, the platform that drives an estimated four in ten websites globally, is built on PHP. So are many ecommerce platforms, booking systems, content management tools, and the kind of custom-built business websites that agencies delivered to SMEs throughout the 2010s. If your site has a contact form, a product catalogue, a members login, or a blog, there is a reasonable chance PHP is involved.
Security researchers have been tracking a cluster of critical PHP vulnerabilities that have now reached the point where governments are issuing formal warnings. The flaw that triggered South Korea's national alert this week sits in PHP's core request handling. Exploiting it does not require sophisticated access. In the right circumstances, an attacker can use it to execute their own code on your web server, read your database, steal customer records, or use your site as a launchpad for attacking other systems. Critical is not a word security teams use loosely.
Why Outdated PHP Is So Common in Small Business Environments
The honest answer is that most SMEs do not think of their website as infrastructure that needs maintaining. It was built, it works, and nobody has touched the back end since the agency handed it over three years ago. The PHP version running on the server is probably whatever was current at the time of the build.
PHP versions have defined end-of-life dates. Once a version hits that date, it stops receiving security patches. An attacker who finds a flaw in an end-of-life version does not need to race the clock on a patch. There is no patch coming. At the time of writing, a meaningful portion of PHP-powered sites are still running versions that reached end-of-life years ago.
Your hosting provider may handle some of this automatically. Many do not, and even those that do often require you to opt in to major version upgrades because they can break older site code. The default position for a site that has not been actively maintained is: still running an old version, still exposed.
AI Is Changing How Quickly These Flaws Become Attacks
There is a wider shift happening alongside this specific vulnerability. As we have covered before in our piece on how AI is compressing the gap between a discovered flaw and an active attack, the time between a vulnerability being published and attackers weaponising it has shortened significantly. Automated scanning tools can identify every publicly accessible server running a vulnerable PHP version within hours of a disclosure. AI-assisted exploit generation means that producing working attack code no longer requires deep expertise. The practical effect for a small business is that the window for action is much shorter than it used to be.
This is not theoretical. The pattern we saw with the increase in zero-day exploitation last year is accelerating. Waiting for your next annual security review is not a workable strategy when a publicly disclosed critical flaw can move from announcement to active exploitation within days.
What You Should Actually Do About This
The good news is that the remediation here is not exotic. It is a version check and a patch. The tricky part for most SMEs is not knowing where to start.
- Find out what PHP version your site is running. Your hosting control panel (cPanel, Plesk, and similar) usually shows this directly. If your site is managed by a developer or agency, ask them explicitly and get a written answer.
- Check whether that version is still receiving security updates. PHP 8.1 reached end-of-life in December 2024. PHP 8.2 reaches end-of-life in December 2025. PHP 8.3 and 8.4 are the currently supported branches. If your site is running anything below 8.2 right now, it is already behind.
- Upgrade to a supported version. On most managed hosting platforms this is a setting change followed by compatibility testing. On unmanaged servers it requires more hands-on work. Either way, it is finite and achievable.
- Check your plugins and themes too. On a WordPress site in particular, the PHP version is only part of the picture. Outdated plugins are a separate attack surface. Keeping your core platform, themes, and plugins current matters just as much as the underlying PHP version.
- Put regular scanning in place. A one-off fix addresses today's exposure. Ongoing vulnerability scanning catches the next one before it becomes the next incident.
The Broader Point About Website Security
For most small businesses, the website sits in an awkward gap. It is not managed by the IT team (if there is one) and it is not actively monitored by the hosting provider. The developer who built it may not be on retainer. Nobody owns the job of keeping it patched.
That gap is exactly where attackers look. A business website holds customer data, contact form submissions, sometimes payment integrations. It runs on a server that could be used to host malicious content or attack other businesses if compromised. The reputational and legal exposure from a breached website is real, and the ICO does not accept "we didn't know our PHP was outdated" as a defence under UK GDPR.
Vulnerability management as a discipline is precisely about closing this kind of gap systematically rather than reactively. Not every small business needs a full security operations setup, but every small business with a website does need to know what software it is running and whether that software is current.
Start with a version check this week. It takes five minutes and it tells you whether you have a problem that needs fixing now or a baseline that just needs monitoring going forward. Either outcome is more useful than not knowing.