PHP security advisory · 21 October 2026
Stop chasing PHP updates.
PHP has just fixed two critical flaws that let an attacker run code on a web server without logging in. Versions 8.1 and older get no official fix. We rebuild your site on Planbrand in 24 hours, with your content exactly as it is.
Move my site in 24 hoursFree to move. Then one monthly website price.
9.2CVSS score of each flaw. Critical, and no login needed (php.net)
69.3%of websites with a known server language run PHP (W3Techs, 22 Oct 2026)
~48%of PHP sites that show their version are on 8.1 or older
31 Decwhen PHP 8.2 stops getting security fixes (php.net)
Which PHP versions got the 21 October fix
Fixed inSecurity supportStatus
PHP 8.58.5.12until 31 Dec 2029Patched
PHP 8.48.4.27until 31 Dec 2028Patched
PHP 8.38.3.36until 31 Dec 2027Patched
PHP 8.28.2.35ends 31 Dec 2026Patched, ends this year
PHP 8.1—ended 31 Dec 2025No official fix
PHP 8.0—ended 26 Nov 2023No official fix
PHP 7.4—ended 28 Nov 2022No official fix
PHP 5.6—ended 31 Dec 2018No official fix
Check your site in five minutes
1Try the WordPress doorAdd /wp-admin to your address, like yourcompany.com/wp-admin. A login page means your site runs on PHP.
2Read the headerPress F12, open Network, reload and click the first line. A line like X-Powered-By: PHP/7.4.33 shows your version.
3Ask the panel, or your agencyThe free Wappalyzer extension, or your hosting panel's PHP setting. Or ask: "Which PHP version is my site on?"
4Still not sure?Put your website in the form at the top. We check it for you and tell you what we find.
What we do in 24 hours
Copy every page and post, word for word
Download your images and put them back in place
Rebuild your forms, so enquiries keep arriving
Connect your domain with a fresh SSL certificate
Back up the new site every day. No PHP, no plugins to update
After you send the form
From the form to your new site
1TodayWe look at your site and confirm what moves.
2Hour 0The clock starts when we have access to your domain settings.
3By hour 24Your site is live on Planbrand: same content, same address, SSL on.
4AfterUpdates and backups are ours. You edit your pages when you want to.
Before you move
No. Wikipedia runs on PHP. The risk is an old version, or a site nobody updates. Every PHP version has an end date, and after it new flaws stay open.
Stop chasing PHP updates.
Your site on Planbrand in 24 hours, content unchanged.