PHP vulnerability: how to check whether your website is affected
Two critical vulnerabilities in PHP put a large part of the web on high alert on 21 October 2026. Government websites went offline as a precaution. But how do you know whether your own website, web shop or customer portal could be affected? In this article, you check in a few steps whether you run on PHP, which version it is and what you need to do today and after the update.
If your website runs on PHP, the PHP version on the server must be updated as soon as the security update is available. That is done by your hosting provider or your developer, not by WordPress or a plugin.
Below, you can check in four steps whether you run on PHP and which version it is. If you use a version that is no longer supported, it will not receive an update and you will need to switch to a newer one first.
Does your website run on PHP?
- PHP runs on the server. You do not see it in your browser, but most classic websites use it.
- WordPress, WooCommerce, Drupal, Joomla, Magento, PrestaShop and Laravel all run on PHP.
- If you use a platform as a service, such as Shopify or Wix, you do not manage a server and the update is the provider's responsibility.
- Updating your CMS or plugins is not the same as updating PHP itself.
- Versions that are no longer supported do not receive a security update. For those, switching to a newer version is the only solution.
PHP is the programming language in which a large part of the websites on the internet are written. It runs on the web server: every time someone requests a page, PHP generates that page. As a visitor, you notice nothing of this, and many website owners do not know their site runs on it either. That is exactly why a critical vulnerability in PHP has such a wide impact.
Whether you could be affected depends on two questions: is there PHP running on the server behind your site, and who manages that server? The overview below answers this for the most widely used platforms.
Does your platform run on PHP, and who takes care of the update?
| Platform | Runs on PHP | Who updates PHP |
|---|---|---|
| WordPress or WooCommerce with a hosting provider | Yes | Your hosting provider. You update WordPress and plugins yourself |
| Managed WordPress hosting | Yes | The provider, usually without you needing to do anything |
| Drupal, Joomla, Magento or PrestaShop | Yes | Your hosting provider or the party that manages the server |
| Custom builds in Laravel or Symfony | Yes | Your developer or maintenance provider |
| Own server or VPS | Often yes | You, or whoever manages the server for you |
| Shopify, Wix, Squarespace and similar services | You do not manage a server | The platform provider |
How to find your PHP version
After the security update is released, the PHP security team announces which versions are vulnerable and which version contains the fix. If you already know which version you run, you can see straight away whether you need to act. There are four ways to find out, from simple to technical.
- Check Site Health in WordPress
In the dashboard, go to Tools, then Site Health, the Info tab, Server section. The PHP version is listed there. In a Dutch-language dashboard, this is called Gereedschap, Sitediagnose.
- Check your hosting control panel
In panels such as cPanel, DirectAdmin and Plesk, the PHP version is usually found in the domain settings, often under the name PHP Version or PHP Selector.
- Ask your hosting provider or developer
Ask which PHP version is running, when they will install the update and whether there is extra protection until then, such as a web application firewall.
- Check on the server itself
If you have access to the server, the command php -v shows the version. Note that the version on the command line may differ from the version the web server uses.
A commonly shared tip is to put a file with phpinfo() on your site. That works, but it shows anyone exactly which version and settings you are running. Today, that is precisely the information attackers want. If you do use it, delete the file straight away.
Is your PHP version still supported?
The PHP project supports each version for a fixed period: first with regular updates, then with security updates only, and after that not at all. If you are running a version outside that period, you will not get an update for this vulnerability. The current overview of supported versions on php.net shows how long each version will be maintained.
This is not a theoretical problem. Many websites still run on PHP 7 or early versions of PHP 8, because switching takes time and the site works fine as it is. With a vulnerability like this, that delay suddenly becomes urgent: a site on an unsupported version stays vulnerable, even after everyone around it has updated.
What the status of your PHP version means for this vulnerability
| Status of your version | Will you get an update | What you do |
|---|---|---|
| Actively supported | Yes | Install the update as soon as it is available |
| Security updates only | Yes, if the version is on the list of affected versions | Install the update and plan a move to a newer version |
| No longer supported | No | Upgrade as soon as possible, and restrict access in the meantime |
Do you need to take your site offline until the update?
The government chose to take sites offline as a precaution. For a business website, that is not always necessary. It depends on what is on the server and how quickly you can install the update. Use the decision aid below: tick what applies to your situation.
Tick what applies to your website or platform. The more ticks on the left, the stronger the case for going offline temporarily or restricting access.
Take offline temporarily
Keep online
Tick above what applies to you.
Take offline temporarily: 0Keep online: 0
What to check after the update
The security update is scheduled for Wednesday 21 October at 4 pm Dutch time. After that, the work is not done. An update that was not installed properly, or a server still running the old version, gives a false sense of security.
- Check the version again
Look in the same place as before to see whether the new version is active. Sometimes the web server or PHP-FPM needs to be restarted before the update takes effect.
- Test the key functions
Logins, forms, payments and integrations. A PHP update rarely breaks anything within the same version, but with older code it can happen.
- Check the log files
Look for unusual requests, unknown files or new admin accounts from the moment of the announcement on 20 October.
- Replace passwords and keys if in doubt
If you see anything suspicious, replace passwords, API keys and database access, and bring in a specialist.
If you use WordPress, also read WordPress and the PHP vulnerability. For background and a live overview of sites that are offline, see the overview of the PHP vulnerability.
Which sites are offline right now
Below you can see live which well-known websites are currently not reachable as normal. This shows how organisations are rolling out the update and when they come back online.
Loading the overview.
From an Appfront server, we measure whether the public homepage loads. We do not test logging in with DigiD. A page that only shows a maintenance message does not count as normally reachable. Is your own platform running on PHP and are you unsure? Have a developer take a look.
the severity score out of 10 (CVSS 4.0) for each of the two vulnerabilities, according to the PHP security team.
ways to find your PHP version, from the WordPress dashboard to the server itself.
the scheduled time of the security update on 21 October (2 pm UTC).
Frequently asked questions
About checking your website for the PHP vulnerability.
How do I know if my website runs on PHP?
If you use WordPress, WooCommerce, Drupal, Joomla, Magento, PrestaShop or Laravel, your site runs on PHP. If you're unsure, ask your hosting provider or developer.
Where do I find my PHP version in WordPress?
In the dashboard under Tools, Site Health, Info tab, Server section. In the Dutch interface this is called Gereedschap, Sitediagnose.
Do I need to update PHP myself?
Usually not. With standard hosting, your hosting provider updates PHP. Only if you manage your own server or VPS, or if it is part of your agreements, do you or your developer do it yourself.
Is a WordPress update enough?
No. The vulnerability is in PHP itself, on the server. Updating WordPress or plugins does not replace updating PHP.
What if my PHP version is no longer supported?
Then that version will not receive a security update. You will need to move to a supported version. Until then, it is sensible to restrict access to the site.
Should I take my website offline?
That depends on what is on it. If the site processes personal data or payments and the update cannot be installed immediately, going offline temporarily is defensible. An informational site can usually stay online if the update is installed straight after release.
Further reading
The PHP vulnerability of October 2026
What is going on, which sites are offline and the timeline.
Read more WordPressWordPress and the PHP vulnerability
What you need to do as the owner of a WordPress site, and what you don't.
Read more LegacyModernising legacy software
Moving off an outdated platform without your work grinding to a halt.
Read moreNot sure whether your platform is safe?
Is your platform running on a PHP version you don't know, or on code nobody dares touch any more? An Appfront developer will look at it with you: which version is running, what the update requires and how to avoid the same scare next time.