22/10/2026
This one's a little technical, but it's important information for anyone with a business website. 🌐
There's still more information coming out about this, but we wanted to share what we know so far to help you understand what it means for your website.
Two critical security vulnerabilities have recently been identified in PHP, the programming language behind websites, including those built with WordPress, Joomla and Drupal.
Both vulnerabilities have been given a severity rating of 9.2 out of 10, and attacks have already begun.
🚨 If drumBEAT hosts and manages your website, there's nothing you need to do. We've already updated PHP across the websites we look after to help protect them against these vulnerabilities.
If your website is hosted elsewhere, we recommend checking the following:
🔒 Your PHP version: Check that your website is running an updated version of PHP (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later patched release). If you're unsure or using an older version, contact your hosting provider for advice on updating it.
🔒 Other websites: Don't forget about staging sites, older websites or microsites that might still be running.
🔒 Avoid temporary fixes: Don't rely on plugins or copied code snippets as a substitute for updating PHP itself.
🔒 Watch for unusual website behaviour: Repeated server errors, unexpected crashes or PHP restarts could indicate a problem. If you notice anything suspicious, contact your hosting provider urgently and review any passwords or API keys stored on the server.
Not sure whether your website is protected? Get in touch with the drumBEAT team, and we'll be happy to help you check: https://www.drumbeatmarketing.co.uk/contact-us/
For more technical information, read here: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php