What changed: Fixes have been released for critical PHP vulnerabilities. TechCrunch reports that AI tools helped uncover the flaws and that the NSA recommended taking sites offline if they could not be patched immediately. PPC Land reports that Google Search Central reminded operators to return 503 responses during maintenance. This report relies on press coverage; a direct official announcement was not found.
Who is affected
Businesses operating websites that use PHP are affected. TechCrunch also reports that WordPress site operators need to patch their servers and work with their hosting providers.
What it means for your business
For businesses using PHP, this means checking server patching and the response delivered during maintenance. According to PPC Land, a 503 response signals temporary unavailability, but persistent errors can still lead to pages being removed from search results.
What to do
Check with your hosting provider whether your website uses PHP. If it does, apply the released patches. Following the NSA advice reported by TechCrunch, keep the site offline until it is fixed if immediate patching is not possible. Verify that the server returns a 503 response during maintenance, as described in PPC Land's coverage.
When it takes effect
PPC Land reports that the patches were released on October 21, 2026. The sources give no separate deadline; TechCrunch reports advice to patch immediately.
Source (press reports): TechCrunch, PPC Land
