Why Business Owners and Marketers Should Care About the PHP Security Fix

Most business owners have never heard of PHP, and that is fine. You do not need to know how your website works to understand this one. The short version: the software behind most of the world's websites had two serious security holes, and on Wednesday, October 21, 2026 the people who maintain it released the fix. If your website runs on that software, someone needs to install the fix now.

Here is what happened, why it matters for your sales and your marketing, and the one email worth sending this week.

So what actually happened?

Think of PHP as the engine under the hood of a website. Visitors never see it, but it does the work every time someone loads a page or fills out a form. According to W3Techs, it runs 69.3% of all websites whose engine is known, including every site built on WordPress.

On October 21, the PHP team announced that it had fixed two flaws rated 9.2 out of 10 for severity, the most serious category there is. That means a stranger on the internet could take control of a website running an unpatched version, without a password and without ever logging in. PHP's advice was short: update immediately, because updating is the only real fix.

The timing matters too. Once a fix is public, attackers study what changed to find the hole it closes, then go looking for websites that have not been updated yet. The days right after a release like this are when an unpatched site is most at risk.

Does this affect my website?

Very possibly. If your website runs on WordPress, if you log in through an address that ends in “wp-admin,” or if someone has ever told you your site needs “plugin updates,” it almost certainly runs on PHP. The same goes for sites built on Drupal, Joomla, WooCommerce, or Magento.

If your site lives on Wix or Squarespace, the platform handles this kind of update for you, and there is nothing for you to install. The same is true for a website built and run by SWATS (more on that below).

Not sure? That is normal. Ask whoever built or hosts your website. They can tell you in a minute.

Is Squarespace or Wix affected by the PHP vulnerability?

People keep asking this one, so here is the short answer: if your whole website is on Squarespace or Wix, you do not need to do anything.

Why should business owners care?

Because your website is not just a brochure. For most businesses it is the front door: where customers find you, size you up, and get in touch. A website someone else controls can hurt you in ways that have nothing to do with technology.

• Your customers' information. Contact forms, quote requests, and booking forms collect names, emails, and phone numbers. A taken-over site can hand all of that to a stranger.
• Your reputation. Hacked sites get used to show fake pages, send visitors to scams, or publish spam under your name. Your customers will not blame the software. They will blame you.
• Your leads. A site that is down, or that quietly stops sending you form submissions, costs you business every day nobody notices.
• Your time and money. Cleaning up after a break-in almost always costs far more than the update that would have prevented it.

Why should marketers care?

Because every campaign ends on the website. Ads, emails, social posts, and search all send people to the same place. If that place is compromised, everything you spent to get people there lands on a problem.

• Paid traffic goes to waste. If the site is down or sending visitors somewhere else, you are paying for clicks that never had a chance to turn into customers.
• Search visibility can drop. Google warns people away from sites it believes are hacked, right in the search results and in the browser. Earning that trust back takes time.
• Your email can land in spam. A hijacked site can be used to send spam from your domain, which can push your real newsletters and follow-ups into spam folders.
• Brand trust is hard to rebuild. One visitor who lands on a scam page with your logo at the top will remember it.

Website security usually gets filed under IT. Weeks like this one are a reminder that it is a marketing topic too.

What should I do this week?

You do not need to become a technical expert. You need to make sure someone is on it.

• Send one email. Write to whoever runs your website (your hosting company, your developer, or your agency) and ask: “Has our website been updated with the October 21 PHP security fix? If not, when will it be?”
• Ask about a backup. Make sure a recent copy of your website exists before anything changes, in case the update breaks something.
• Check your site afterward. Once you hear it is done, visit your homepage, send yourself a message through your contact form, and test a booking or a checkout if you have one. A patched site that quietly stopped sending you leads is its own kind of outage.
• If nobody knows who is responsible, that is your answer. A lot of businesses will discover this week that nobody is watching their website. That is the most important thing to fix, and it is far better to learn it now than after a break-in.

What if my website is a few years old?

This is the part that catches the most small businesses. The official fix only covers the versions of PHP that are still supported. Older versions no longer get regular updates, and according to W3Techs, more than a third of PHP websites still run one of them. For this release, PHP did publish an emergency fix for a few older versions, but it is a stopgap a developer has to apply by hand, not a normal update.

Some hosting companies patch older versions on their own, so ask yours. If they do not, the fix for your site is not a quick update. It is an upgrade, and on an older WordPress site with old plugins and a custom design, that is a project, not a button. Start that conversation now. We have written more about how security updates pile up over time and about the WordPress flaw no amount of careful maintenance could have prevented.

Are SWATS websites affected?

No. Smart Websites built by SWATS do not run on PHP. There is nothing to patch, no server to babysit, and no plugin list to audit, which is part of the SWATS Standard every site we build follows. When a notice like this goes out, our clients have nothing to check and nothing to schedule.

That is the whole point of SWATS. We build or rescue your website, and keeping it current, secure, and fast is our job, not yours. When something needs to change, you send an email. We make the change, you approve a preview link, and it goes live. Weeks like this one become something you read about, not something you manage.

Want to know if your site is in trouble? Email hello@swats.ai and we will get back to you on what your site runs on and how to fix it. No obligations.

This is the way. 🤖

— Jenaro Diaz, Founder & CEO, SWATS