Addressing the PHP vulnerability

PHP, the technology that powers an estimated 70% of the web, received a critical security patch yesterday (21st October 2026).

Following the release of the patch mid-afternoon UK time, working alongside our hosting partner, ProStack, we successfully patched all of our client websites.

If you are a client of Indulge and we look after your website, then it will be secure and patched. Feel free to get in touch with us if you have any questions or concerns.

What happened

PHP is a technology that sits beneath an estimated 30 million websites. It sits below many common content management systems, including WordPress, Drupal, and Joomla.

With the help of AI, researchers uncovered a critical vulnerability within the technology. Details that a flaw had been uncovered leaked on 20th October,  after which PHP announced a security patch.

The flaw would mean that, if exploited, attackers could gain access to personal information, reading things like passwords, tokens, and API keys.

The security release was made available mid-afternoon yesterday, after which it became critical for those relying on PHP to apply.

Who is affected

An estimated 70% of the web, amounting to some 30 million websites, have been affected. Given the critical and time-sensitive nature of the security release, many sites opted to go offline until the security fix had been applied.

A number of government sites went offline, including gov.gg, the Office for Budget Responsibility, and NHS Scotland.

For users of the web, you’ll notice some services will remain offline, or partially offline while patches are applied.

What to do

If you run a website and you aren’t sure whether you use PHP, check with whoever hosts or manages your site.

All Indulge client sites are patched and online, so there’s no further action required.