Is your website affected by the PHP flaw? Fix it today, then stop worrying about the next one

A critical security flaw in PHP, the software behind WordPress and millions of other websites, is being targeted by attackers right now. If your website runs on WordPress, ask your host today to confirm they’ve fixed it. Once that’s done, it’s worth asking a bigger question: does your website need all that software in the first place?

First, get today’s fix in

On 21 October 2026 the PHP project released fixes for two critical flaws that can let an attacker take control of a web server without logging in. Updating WordPress or your plugins won’t fix this. PHP itself has to be updated, and that’s normally your hosting company’s job.

• Email your host or web developer and ask them to confirm, in writing, that PHP on your site includes the 21 October fixes.
• If they can’t confirm it, the National Cyber Security Centre says to consider taking the site offline until they can.
• Ask them to check for signs of a break-in since 17 October, when the first attack attempts were seen.

Our sister company AlphaSec has a full guide to checking whether you’re affected, including an email you can copy and send to your host.

Switching websites isn’t today’s fix. A new website takes days and patching takes minutes, so do both, in that order.

Why our websites weren’t affected

A typical WordPress site builds each page when someone asks for it. PHP runs on the server, fetches your content from a database and runs whatever plugins are installed. That’s a lot of software to keep up to date, and this week shows what happens when one piece of it has a serious flaw.

AlphaPixel websites work differently. Every page is built in advance and served as a ready-made file. There’s no PHP, no database and no plugins on the server, so this flaw had nothing to attack. None of the Alphabyte Group’s websites were affected, including this one.

No website is unhackable, and we won’t pretend otherwise. But this approach removes the most common ways small business websites get broken into, and keeping the site secure is our job, not yours.

What moving looks like

1. A free homepage. We redesign your homepage from your own wording and photos and email you a private link, usually within one working day.
2. We build the rest, for £495. Your existing content, tidied up, with search engine basics set up properly and old page addresses redirected so you don’t lose visitors.
3. We switch it over. We point your domain at the new site. Your email isn’t touched, so nothing else changes on the day.
4. We look after it, for £69 a month. Hosting, security certificates, monitoring and your changes, all included. There are no plugins for you to update, ever.

Prices exclude VAT. If your site needs something like online payments or a client login, we’ll tell you up front how we’d handle it before any work starts.

Is it worth moving?

If your website is mainly a shop window, telling people who you are, what you do and how to get in touch, it almost certainly doesn’t need PHP and a database behind it, and moving makes sense. If it runs an online shop, bookings or a members’ area, the answer depends on how it’s built, and we’ll give you an honest one.