Your website may handle customer inquiries, appointment requests, and online sales. But who is responsible for keeping the software behind it secure?

A security disclosure from Wiz Research, known as PHP2Shell, highlights why that question matters. The researchers described vulnerabilities in PHP, a programming language used by many websites and business applications. Under certain conditions, these weaknesses could allow attackers to access sensitive information or execute unauthorized code on affected servers.

For businesses in Red Deer and Central Alberta, this is a timely reminder to include website security in your broader IT maintenance plan.

PHP is a programming language that runs on web servers, helping websites process information and deliver content. You may rely on it every day without seeing or managing it directly.

Your website developer may maintain the site, while your hosting provider manages the server. When responsibilities are divided, it is not always clear who handles security updates.
The reported PHP2Shell issues concern PHP itself. Updating website content, themes, or plugins does not necessarily fix a vulnerability in the underlying PHP installation. The risk depends on the affected software, configuration, and whether appropriate fixes have been applied.

What Could This Mean for Your Business?

On a vulnerable system, successful exploitation could expose information or allow unauthorized actions on the server. Potential business impacts include missed inquiries, interrupted online services, recovery expenses, and reduced customer confidence.

A vulnerable website does not automatically mean your office computers or email are compromised. However, it is worth understanding whether your website connects to other business systems and what information those connections can access.

1. Find Out Which Systems Use PHP

Ask your website developer, hosting provider, or application vendor whether your website or business applications use PHP. Include older websites, customer portals, and tools that may not be part of your regular maintenance schedule.
or urgent security alerts and request confirmation when critical updates are complete.

2. Confirm Security Updates and Follow-Up Checks

Ask the responsible provider to review the relevant PHP security advisories and confirm whether applicable fixes or vendor-supplied patches have been installed. A version number alone may not tell the full story because some vendors backport security fixes.
• Have all relevant PHP installations been assessed and patched?
• Have affected services been restarted, where necessary, and checked?
• Have contact forms, booking tools, logins, and other key functions been tested?
• Have any follow-up advisories or configuration recommendations been reviewed?
The original draft references October 21 and October 23, 2026 advisories and specific PHP release numbers. These details should be checked against official PHP notices before publication.

3. Review Your Backups and Recovery Plan
Before making changes, confirm that current backups exist and that someone can restore them. Include website files and databases; office-computer backups may not cover externally hosted websites.

Backups support recovery, but they do not replace security patches. If a compromise is suspected, the provider should investigate potential unauthorized access in addition to applying updates.

4. Assign Clear Responsibility

Document who maintains your website, hosting environment, business applications, and office systems. Identify a contact for urgent security alerts and request confirmation when critical updates are complete.

Security alerts are easier to manage when maintenance, backups, and support responsibilities are clearly organized.

MyTechOnsite supports businesses in Red Deer and Central Alberta with IT services such as software patching, proactive monitoring, preventative maintenance, security reviews, backup solutions, and business continuity planning. These services help businesses manage the broader technology risks that security alerts bring into focus.

For externally hosted websites, start with your hosting provider or website developer to confirm the status of PHP updates. For your internal business technology, consider whether your current IT support and recovery plans are keeping pace with your needs.

Not sure where to start? Contact MyTechOnsite to discuss your business IT security, maintenance, and backup needs.

Follow us on Facebook, Instagram, and LinkedIn!

What is residential computer support?

Residential computer support helps homeowners troubleshoot, repair, and maintain computers and home technology systems.

Do you offer remote support for home users?

Yes. Many residential issues can be resolved securely through remote IT support.

Can you help with Wi-Fi and home networks?

Absolutely. MyTechOnsite helps optimize home internet and network performance.

Do you repair laptops and desktop computers?

Yes. We repair and support both laptops and desktop systems for residential clients.