A critical security flaw in PHP, the software that powers WordPress and most websites, was patched on 21 October 2026, and attacks have already been reported. Here’s what it means for your business website, and what you need to check today.