What happened
In October 2026, two serious security flaws were found in PHP, the software that quietly runs a large share of the world’s websites, including most agency sites. The news spread quickly, from technical journals to Forbes, because the flaws could let an outsider take control of a website’s server.
Fixes were released on October 21, and some early attacks have already been reported.
Why it matters to an agency
An agency website is more than a brochure. It is the public face of your board, it carries your talent’s images and measurements, and for many agencies it draws that material live from Booker. A compromised site can be defaced, used to spread malware, or used as a way into the information behind it.
Fixing this is not always a single switch. The PHP fixes cover only current versions, so a site built on an older version has to be moved up to a supported one.
That means reviewing the site’s code, adjusting what needs adjusting, and testing the pages, forms and Booker connection to be sure everything behaves exactly as before.
What we’re doing
For the agency websites we built and maintain, the work began the day the fixes were released. Our developer, Raphael Calintro, is updating each site in turn, starting with those most exposed, and testing every one before it is returned to normal.
There is no charge to our clients for this. It is a substantial piece of work, but we consider it part of looking after the sites we built.
Most maintenance happens out of sight; this time the headlines were loud enough that we wanted you to know it is being done on your behalf.
What you need to do
If we look after your website, nothing. We will let you know when your site is complete, and if anything looks unusual in the meantime, simply get in touch.
If someone else looks after your site, it is worth one short question to them this week: has our site’s PHP been updated for the October security fixes? A clear yes is all you need to hear. If the answer is uncertain, we are glad to take a look.
Good maintenance is rarely visible, and that is as it should be.
We are grateful for the trust our clients place in us, and we intend to keep earning it.
Sources
- php2shell: frequently asked questions (Tenable)
- Two critical PHP flaws trigger emergency alert (The Hacker News)
- Critical PHP vulnerabilities leaked ahead of patch (Infosecurity Magazine)
Let us know
- Have questions about this update? Contact us.
- Running Booker at your agency and ready for a new website that is connected and secure? Let’s talk.
- An agency that wants its website connected to its booking system? Tell us about it.
