The short answer. Most small websites run on a piece of software called PHP. Think of it as the engine under the bonnet. On 21 October 2026, two serious holes were found in that engine. The holes let a stranger trick a website into running their code, without ever logging in. Fixes came out the same day, but only for versions that are still being looked after. If your website runs on PHP 8.1 or older, the makers have stopped fixing it, so there is no fix for your version. Lots of B&B websites are in exactly that spot: built years ago, working fine, and never looked at since. Type your web address into the free check further down and you will know within seconds which side of the line you are on.
PHP is the engine that runs WordPress and most small-business websites. On 21 October 2026, the team that looks after PHP announced two serious holes in it. The holes are logged under the reference numbers CVE-2026-109618 and CVE-2026-109619, and together they have been nicknamed php2shell. Each one scores 9.2 out of 10 for seriousness, which is near the top of the scale. In plain terms, either hole can let a stranger send a carefully written message to your website and make the computer behind it run their code. They do not need a password. In the worst case the PHP team describes, it can happen before your website's own code even wakes up.
Fixes were published the same day, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team's own advice is blunt: there is no workaround that fully protects you, and updating is the only safe move.
Two things matter if your site is not new. First, a fix only exists for versions that are still being looked after. The announcement says plainly that PHP 8.1 and older no longer get updates from the PHP team. Second, the team did something unusual: for people who build PHP themselves from its raw code, they also released small patches for PHP 7.4, 8.0 and 8.1. That tells you how serious this is. A normal hosting account will not receive those patches on its own, which is why checking your version matters.
Every version of PHP gets two years of full attention. Then it gets two more years when only security holes are fixed. After that it reaches what engineers call end of life. In plain terms, the makers have stopped fixing it, a bit like a phone that no longer gets updates. The version does not stop working. Your website looks exactly the same the day after. It just stops getting safer.
| PHP version | Where it stands in October 2026 | Security fixes stop |
|---|---|---|
| 8.5 | Fully supported | 31 December 2029 |
| 8.4 | Fully supported | 31 December 2028 |
| 8.3 | Security fixes only | 31 December 2027 |
| 8.2 | Security fixes only, and nearly out of time | 31 December 2026 |
| 8.1 and older, including all of PHP 7 | End of life: nobody is fixing it | Already stopped |
Plenty of small accommodation websites are sitting on PHP 7.4, 8.0 or 8.1. Nobody did anything wrong. The site was built, it worked, bookings came in, and there was never a reason to open the hosting control panel again. Hosting companies do not always move you to a newer version on their own. A jump can break an old site, and they would rather leave a working site alone than break it quietly. The result is a website that looks fine and has quietly gone years past its last security fix.
If your site runs on WordPress (most B&B sites do), here is where the version number hides:
If your site is not on WordPress, or you cannot log in:
Now compare your number with the table above. On 8.2, you have the fix for now, but the clock is ticking: fixes for 8.2 stop on 31 December 2026. On 8.1 or lower, your version is past the end, and the rest of this page is about your options.
You do not need to know any version numbers for this one. Type in your website address, press the button, and within a few seconds you will get a straight answer: whether the October 2026 holes affect your site, and what to do about it. The check only looks at information your website already shows to anyone who visits. Nothing is installed on your site, and we do not keep your address.
Your result will appear here.
Some websites keep their version number hidden. If yours is one of them, the checker will tell you, and the two-minute check above is the fallback.
If you have already found your version number, pick it here. You will see straight away whether it is still being looked after, whether the October 2026 fix covers you, and what to do next.
Choose your version above and your result will appear here.
First, keep this in proportion. An old version does not mean your site has been hacked, and nobody is picking on your guesthouse by name. The risk works like this. When a hole is announced, the details are published for everyone to read. After that, computers go looking for websites that still have the hole, automatically, day and night. An old version means every hole found from now on stays open on your site for good, including this month's pair, where the attacker does not even need a password.
If someone does get in, the results are usually dull rather than dramatic: your pages changed or sent off to spam sites, junk pages hidden under your web address, or your hosting account used to send spam email. That last one can get your address blacklisted, so your booking enquiries start landing in guests' junk folders. And a B&B website is not just a brochure. Your enquiry forms hold guests' names, dates and contact details. If your booking system runs as a plugin, a small add-on inside your website, the booking path itself sits behind the same engine. That is the part of your business the version number is quietly standing guard over.
1. Move up to a newer PHP version, where your site sits. This is the right answer for most sites, and it is often free: your host flips a switch and your site carries on. It suits you if the building blocks of your site, its theme and its add-ons (plugins), are still being looked after by the people who made them. The one real risk is that an add-on written for PHP 7 falls over on PHP 8. So do it in the safe order: full backup first, then the switch, then walk through your pages and your booking path one by one. Ask your host to do it, or to try it on a practice copy first, and agree up front that they will switch you back if anything breaks. A careful upgrade that goes wrong costs you an afternoon. Staying on an unfixed version costs nothing today and carries the risk every day from now on.
2. Keep the site, and put the fixing on someone else's calendar. If the website earns its keep and you simply never want to open the admin area, paying someone to look after it is a fair answer: they keep WordPress, the theme, the add-ons and the PHP version up to date for you, and check the site afterwards. It suits owners whose site is sound but whose attention is elsewhere. The version problem is rarely about knowledge. It is about the job belonging to nobody. This route gives it an owner.
3. Start again with a hand-built website. If the check is bad at every level, an engine nobody fixes any more, add-ons their makers have walked away from, a design from before most guests booked on phones, then fixing it piece by piece can cost more than starting again. This is the route we work in. We hand-build your direct booking website for a one-time £1,999, with your existing booking engine fitted into it. As we put it on our channel manager page: on WordPress, tools like a booking engine usually arrive as a plugin, and a plugin is one more thing to update and keep secure. A hand-built site has no templates and no page builders, and the whole upkeep chain, WordPress, theme, plugins and PHP version, is simply no longer yours to chase. See our B&B website cost guide for how the one-off build compares with ongoing platform and maintenance costs.
If your site runs on WordPress, log in to your admin area and go to Tools, then Site Health, then the Info tab. Open the Server section and your PHP version is written there. If your site is not on WordPress, log in to your hosting control panel and look for Select PHP Version or MultiPHP Manager, which shows the version set for your site. If neither route works, ask your host one question: which PHP version is my site running, and is it still being looked after? Or use the free checker on this page: type in your web address and it will tell you whether your version shows from outside.
As of October 2026, PHP 8.2, 8.3, 8.4 and 8.5 are still being looked after. PHP 8.2 is in its final stretch, getting security fixes only, and reaches the end on 31 December 2026. PHP 8.1 and everything older, including all of PHP 7, are past the end: the PHP team no longer publishes security fixes for them.
No. An old version does not mean your site has been broken into. It means that when a new hole is announced, no fix is published for your version in the normal way. The holes fixed on 21 October 2026 are a live example: fixes came out for PHP 8.2 to 8.5, while PHP 8.1 and older received no regular release. Treat it as a job to book in, not a fire to panic about, and book it in soon.
It can, if your theme or your add-ons are old. An add-on written for PHP 7 may fall over on PHP 8, which is why updates should be done with a full backup first and, if you can, tried on a practice copy first. In practice, most hosts will flip the switch for you and flip it back if anything breaks. The risk of a careful update is small and short-lived. The risk of staying on an unfixed version does not go away.
No. Those companies run on their own systems, and bookings there carry on as normal. What runs on your PHP is your own website: your pages, your enquiry forms and, if your booking system is a plugin inside your site, your direct booking path. That is the part worth protecting, because it is the route where guests' details come straight to you.
Usually not. If your WordPress site is otherwise doing its job, updating PHP and keeping WordPress, the theme and the add-ons looked after solves the problem. A rebuild is worth thinking about when the site is old at every level: a PHP version nobody fixes any more, add-ons their makers no longer maintain, and a design from before most guests booked on phones. In that case the rebuild takes the whole upkeep chain away instead of repairing it link by link.
If your check comes back with a version that is still looked after, good: make a note of the date its fixes stop, set a reminder, and get on with running your property. If it comes back old, you now know the three routes and roughly what each one costs in money or attention. And if the site is due a rebuild anyway, a hand-built website takes the whole patching treadmill off your list for good.
Hand-built website, £1,999 one-time, 0% commission. See your own B&B first with a £9.90 demo.
Try a £9.90 demoQuestions? Call +44 7727 811227 (24/7 AI) · WhatsApp (human) · hello@directbook.uk
Last checked: 21 October 2026. General guidance only, not security or legal advice. Sources: PHP security advisory, "Critical remote code execution vulnerabilities, update now" (php.net, 21 October 2026); PHP Supported Versions (php.net, checked 21 October 2026); PHP release announcements for 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (php.net, 21 October 2026); PHP security release advance notice (php.net, 20 October 2026).