Is your clinic website running outdated PHP? A 2-minute security check for Indian clinics

Check your clinic website's PHP version this week. On 21 October 2026 the PHP project fixed two critical flaws, nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619), that can let an attacker run code on a server without logging in. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4 has been end of life since 28 November 2022 and gets no official fix. The check takes about 2 minutes; on most shared hosting the switch is a setting in your hosting panel.

General guidance, not a guarantee or a substitute for a review of your specific site. Only check sites you own or manage. Facts checked on 23 October 2026; links to each source are inline.

What happened this week

• Two critical PHP bugs, rated 9.2. The PHP security team rates both CVE-2026-109618 and CVE-2026-109619 at CVSS v4.0 9.2 and says an unauthenticated remote attacker can exploit them (php.net announcement, Tenable FAQ).
• Every PHP site serving web requests is in scope. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed (Canadian Centre for Cyber Security, AL26-026).
• Patch now. The US agency CISA urges an immediate update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and says systems still on PHP 8.1 or older should be taken offline until updated (CISA alert, 21 Oct 2026).
• Attacks have been reported. Tenable cites Amazon Threat Intelligence seeing an exploitation attempt on 17 October and broad exploitation since (Tenable).

Why old PHP 7.x is the real problem

PHP 7.4 reached end of life on 28 November 2022 (php.net end-of-life branches). The branches PHP still supports are 8.2, 8.3, 8.4 and 8.5, and 8.2's security support ends on 31 December 2026 (php.net supported versions). Older branches get no official release for php2shell; the PHP team published only minimal source patches for 7.4 to 8.1, which a typical shared-hosting site can't apply itself (Tenable).

The 2-minute check

• From a terminal. Run curl -sI https://yourclinic.example | grep -i x-powered-by. A line like X-Powered-By: PHP/7.4.33 shows the version. No line doesn't mean you're safe: many hosts hide this header.
• From the browser. Open DevTools (F12) → Network, reload, click the first request and look for X-Powered-By under Response Headers.
• cPanel. Software → MultiPHP Manager lists the PHP version for each domain (cPanel docs). Some hosts show Software → Select PHP Version instead (Hostinger cPanel guide).
• Hostinger hPanel. Websites → Dashboard → PHP Configuration (Hostinger help).
• Not sure? Ask your web developer or host: "Which PHP version does our site run, and is it patched for CVE-2026-109618 and CVE-2026-109619?"

Why it matters for a patient contact form

Appointment and contact forms collect names, phone numbers and sometimes symptoms. If an attacker can run code on the server, they can read what the site stores or emails out, change the form, or plant malware on pages patients visit. The flaws also allow reading data from server memory (NHS England Digital, CC-4875). Keep only what the form needs, and don't ask for medical details on a public web form.

The switch: a setting in your hosting panel

• Back up first. Download a full backup of files and the database from your hosting panel.
• Test on a copy if you can. Use a staging site, or switch at a quiet hour. Update WordPress, your theme and plugins first; old plugins are what usually break on PHP 8.
• Pick 8.3 or newer. Choose 8.3, 8.4 or 8.5 in MultiPHP Manager or hPanel and click Apply/Update. 8.2 works but leaves security support on 31 December 2026. Hostinger no longer offers 8.1 or lower for new selections (Hostinger).
• Check the site. Open the home page, submit the contact form once, and confirm the message arrives. If something breaks, switch back, restore the backup and fix the plugin.
• Confirm the patch level. Your host must also run the patched build (8.3.36 or later on the 8.3 branch, and so on). Picking "8.3" in a panel doesn't by itself prove that.

Get a free site score

Want a quick outside view of your clinic site's security headers, speed and SEO? Get your free site score at chikuos.com. It's a passive check of public pages only. For a person to review it, see the AI Site Audit.