Two recently disclosed critical vulnerabilities in PHP, the open-source scripting language widely used to run websites and web applications, have renewed attention on a broader security problem: many organisations still depend on aging code and hard-to-maintain web stacks.

While the immediate alarm around the PHP flaws may have eased, the underlying issue has not. The episode shows how a single vulnerability in a widely used open-source component can force companies to patch urgently, take services offline, or assess whether older systems can still be secured in a reasonable way.

What happened

According to the source, two critical bugs were found in PHP, a language that powers a large share of the web. The flaws reportedly led some organisations to scramble to patch affected systems, and in some cases to temporarily take websites offline until mitigations were in place.

The source frames this as part of a larger problem affecting older internet infrastructure and long-lived software. That matters because business websites, customer portals, e-commerce stores and internal tools often rely not only on PHP itself, but also on frameworks, plugins, third-party packages and custom code built over many years.

Why it matters for European businesses

For European businesses, this is not just a developer issue. Website vulnerabilities can quickly become an operational, commercial and compliance risk.

• Revenue risk: If an online store, booking platform or lead-generation website must be taken offline for emergency patching, sales and customer acquisition can be disrupted.
• Security exposure: Critical flaws in common software are often rapidly incorporated into attack activity once details become public.
• Hidden technical debt: Older websites may depend on unsupported PHP versions, outdated content management systems or custom integrations that are difficult to patch without breaking business processes.
• Compliance implications: If a vulnerable system processes personal data and is later compromised, businesses may face GDPR-related incident response obligations in addition to operational disruption.

The wider lesson is that open-source software remains essential to digital business, but dependency on unmaintained or poorly documented code can turn a routine security update into a costly emergency.

Who may be affected

The impact is likely to be greatest for organisations with limited internal security resources or older web infrastructure.

• SMEs running older websites or customer portals built years ago and updated only when necessary.
• E-commerce companies whose stores depend on PHP-based platforms, plugins or payment-related integrations.
• Marketing teams operating campaign microsites, landing pages or form systems managed across multiple vendors.
• IT teams and agencies responsible for maintaining several client environments with inconsistent hosting, update policies or documentation.
• Businesses in regulated sectors where service continuity, data protection and security controls are subject to stricter internal governance.

Companies may be especially exposed if they do not have a current inventory of web applications, hosting environments, software versions and third-party dependencies.

What companies should consider

• Identify exposure: Review whether public-facing websites, internal tools or client portals rely on PHP, and confirm which versions are in use.
• Patch quickly but carefully: Apply available security updates after testing, especially where websites depend on older plugins, templates or custom code.
• Audit legacy dependencies: Check frameworks, CMS components, extensions and libraries for unsupported versions or abandoned maintainers.
• Improve asset visibility: Maintain an up-to-date inventory of domains, applications, hosting providers and software components.
• Prepare fallback plans: Define how to temporarily disable vulnerable functions, restrict access or restore service if urgent patching is required.
• Review ownership: Clarify whether internal teams, hosting providers, freelancers or agencies are responsible for security updates and emergency response.
• Plan modernisation: If patching repeatedly becomes difficult because of outdated architecture, this may indicate a need for redevelopment rather than another short-term fix.

For many businesses, the immediate PHP incident is only one example of a larger challenge: security risk accumulates in legacy code over time. Organisations that treat website maintenance as a strategic business function rather than a purely technical afterthought are typically better positioned to respond when the next critical flaw appears.