How do I know if my business website uses PHP?

You do not have to work it out yourself. Email whoever hosts or built the site and ask for the exact PHP version number, because the booking form, the invoice tool and the webmail nobody opens are exactly the things that sit on PHP. The version number in the reply is the answer you need.

Which PHP versions are safe after the October 2026 security release?

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published on 21 October 2026. Older releases in those branches are still open. PHP 8.1 and everything before it is end-of-life, so no patch is coming and the branch itself has to be upgraded.

What does a good answer from my hosting provider look like?

A version number of 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer, the date the update was applied, and confirmation that the service was restarted afterwards. A claim of being fully patched with no version number is not an answer, and neither is a reference to the firewall.

Small Business PHP Check: The One Question to Send Your Host

October 22, 2026 3 min read

Dark banner reading 'Your business runs PHP. Probably.' beside a printed receipt listing website, PHP version, patch date 21 October 2026 and safe build 8.2.35+

You do not know what is in your basement, but you definitely have one. Underneath the website sits the booking form, the invoice tool, the webmail account nobody has opened since the last bookkeeper left. On most small business setups that floor is built out of PHP, and on 21 October 2026 the people who maintain PHP shipped an emergency fix for it.

What happened, in owner language

Two flaws, CVE-2026-109618 and CVE-2026-109619, let a stranger on the internet make your server run their instructions. No password needed, no staff member tricked into clicking anything.

The repaired releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older inside those branches is still wide open. PHP 8.1 and everything before it has reached end-of-life, which means no fix is coming at all and the whole branch has to move up.

One more point worth carrying into the conversation. On the older Apache setup with mod_php, the attack arrives before your own website code runs, so login screens and security plugins never get their turn.

Send this one email

Write to whoever hosts or built the site: “Which exact PHP version do we run, and have you applied the 21 October 2026 security release?”

A passing reply contains a version number from the list above, the date it was done, and a note that the service was restarted afterwards. “We are fully patched” with no number is not a reply. “Our firewall covers that” is the wrong reply. Nothing at all after a working day tells you plenty about the provider.

Updates must come from php.net, from your distribution’s own repositories, or from your hosting company. Anybody else offering a quick fix for this is selling you a second problem.

Confirm it rather than trust it

If there is a server your people can log into, this read-only script lists the PHP it finds and marks what is unpatched or expired.

curl -fsSL https://blog.limewire.com/content/files/2026/10/php-exposure-check.txt -o php-exposure-check.sh
less php-exposure-check.sh
sh php-exposure-check.sh

Its SHA-256 is c13cd5690c9d352c6a95e854602be2f330a0799435c05a8261037401fcf50255. It finishes with 0 when every install it located is current, 1 when at least one is behind or unsupported, and 2 when it finds no PHP.

Not a terminal household? The same file is posted on our own platform by the verified account @limewireofficial: php-exposure-check.sh. No signup, no download cap, and the link will not expire before your web person gets around to it.

Then hand the rest to someone technical

We should admit our history here. In the 2000s, LimeWire was how a lot of people ended up with a three-minute song that arrived as a suspiciously small file ending in .exe. This PHP flaw is not ours in any sense — we simply recognise the genre, and we went straight a long time ago.

If you have a developer, a freelancer or an agency lead, send them the full technical breakdown of CVE-2026-109618. Every platform, container image and version number is already sorted out there, which saves them an afternoon and saves you a phone call.