A new vulnerability could cost businesses dearly: why you should check your site today

On October 21, 2026, PHP developers released emergency patches for two critical vulnerabilities. Under certain conditions, they allow attackers to break into servers without knowing passwords. Websites of small stores, hotels, medical offices and other businesses may be at risk. How dangerous is this for ordinary business and how much might protection cost?

What can a hack do to a small business?

Imagine an unknown person gains access to the server where your website runs.

Dental clinic: the criminal steals the patient database and demands money, threatening to publish confidential information. 

Small hotel: theattacker obtains booking data and sends fraudulent payment demands to guests.

Online store: the hacker steals the customer database, swaps payment details, or takes the store offline.

Corporate website: the criminal blocks its operation, destroys available backup copies, and demands a ransom for restoration.

These are possible scenarios, not inevitable consequences. The scale of damage depends on which data and systems the attacker gains access to.

What is the likelihood that your site will be hacked?

Small business size does not protect against hackers. The criminal does not need to know about the existence of your company. Special programs can automatically scan websites for known vulnerabilities.

A single successful attack is enough to cause serious damage.

It is impossible to give an exact probability of hacking an individual site: it depends on the state of the software and server protection.

But the threat is no longer theoretical. Cloudflare reports that it observes attempts to exploit the new vulnerabilities.

Which sites are at greatest risk?

First of all, sites created years ago and practically not updated since.

Moreover, regularly changing prices, photos, and texts does not mean that the server software is being updated.

Even if your website is under maintenance, it is worth checking whether specialists are indeed regularly installing security updates.

New vulnerabilities may also affect relatively modern sites if the necessary patches have not yet been installed.

How urgently should you act?

Very urgently. Patches were released on October 21, but attack attempts have already been detected.

The U.S. National Security Agency recommends immediately updating vulnerable systems, and if protecting them is not yet possible, considering temporary shutdown.

The Japanese Ministry of Finance on October 21 even temporarily suspended some of its web services to carry out necessary checks and updates.

This does not mean that every vulnerable site will definitely be hacked in the coming hours. But postponing the solution of the problem to next week is unreasonable.

What should a business owner do?

Contact the person or company that usually maintains your website. It could be a programmer, system administrator, or web studio. One message is enough: Critical PHP2Shell vulnerabilities have appeared, allowing a site to be hacked without a password. Please check our site and server. Are we protected from this threat? If not, what needs to be done, how urgent, and how much will it cost?

You do not need to delve into server settings yourself. It is important to get a concrete answer on whether the site is protected, and if not, when the issue will be fixed.

How much will it cost?

Three situations are possible.

No additional cost. If updates are covered by the maintenance contract, specialists can fix the problem within already paid services.

Small one-time work. If the site is compatible with patches, checking and updating may only require a few hours of a specialist's time.

Expensive modernization. If the site runs on long-outdated software, substantial changes may be needed. The cost depends on the complexity of the site and in some cases reaches hundreds or thousands of euros. However, even for old sites, special patches sometimes exist that avoid an immediate complete rebuild.

The main thing: if your business has a website, today it is worth contacting those who maintain it. Even if everything works flawlessly. A few minutes spent on verification can protect against customer data leaks, halted sales, and costly recovery.

Sources: PHP Foundation, Cloudflare, U.S. NSA, Japanese Ministry of Finance.