By Sara Khan · WeProms Digital · October 21, 2026
On October 21, 2026, PHP — the software layer that runs beneath every standard WordPress site — shipped emergency fixes for two flaws rated 9.2 out of 10 for severity, after researchers at Wiz demonstrated a takeover chain that works on ordinary WordPress deployments without a login. Roughly 70 percent of the world’s websites run on PHP; WordPress alone accounts for 39.6 percent of all websites. A Pakistani-owned umrah agency in Manchester sits squarely on that stack, and the timing is unforgiving: Ramadan 2027 is expected to begin around February 8, 2027, subject to moon sighting, and UK umrah enquiries for that season start building from November.
The LOCK framework breaks a website security emergency into four moves: L to Locate the software version your site runs, O to Open the ticket with your host, C to Check what an attacker may already have left behind, and K to Keep watch through the booking season. The order is the point; an owner who patches in one email but never retests the booking forms has bought a new lock and left the window open.
An umrah brand’s website carries more than a brochure.
It holds enquiry forms, deposit references and — in most agencies — scanned passports attached to booking emails. Trust arrives sideways, through WhatsApp recommendations from mosque committees and family groups, and a “this site may be hacked” warning in the booking window burns the season rather than the week. Families judge an agency the way travelers judge a queue at Manchester Airport before Eid flights: one visible failure and everyone reroutes to the operator next door.
L — Locate the version: one screen tells you whether you are exposed
In WordPress, open Tools, choose Site Health, select Info, and expand Server; the PHP version your site runs appears on that screen, and it takes under two minutes to find. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anything older — including every PHP 8.1 install — is past end-of-life and no longer receives regular fixes at all.
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed php2shell, reach back to PHP 5.4, which covers every release of the past decade. What actually drives the risk is not the theme or the plugins; it is the software version running beneath them.
“These flaws are in the PHP runtime, so updating website code or a plugin(s) alone does not fix these vulnerabilities.” — Cloudflare Blog, October 21, 2026
That quote answers the question owners ask first. A WordPress update will not patch this; a plugin update will not patch this. If the hosting account allows version switching through cPanel, the panel’s selected version still has to include the October 21 fix — Search Engine Journal advises confirming exactly that with the host before trusting the switch.
The single action from this section: write the version number on one line, today, and keep it beside the hosting login.
O — Open the ticket: the email that gets a patch date, not a promise
Vague tickets get vague replies, so send a specific one. Paste this into the host’s support form and adapt the bracketed parts:
“Subject: PHP security patch request — CVE-2026-109618 / CVE-2026-109619. Please confirm in writing: (1) the PHP version our account runs today; (2) the date you will apply a patched release (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12); (3) whether we can switch versions ourselves in cPanel; (4) that a full backup will be taken before the change. Our forms collect customer passport data, so timing matters. — [Agency name], Manchester”
A firewall in front of the site buys time while the ticket waits. A WAF — a web application firewall, a filter that sits between visitors and your server — blocked known attack patterns from October 21, with Cloudflare deploying managed protections for free and paid plans roughly nine hours before public disclosure. A filter is a bridge, not a cure; the same advisory is blunt that a WAF is not a substitute for installing the fixes.
One claim here is worth testing against your own host: if the reply cannot name a patch date within 48 hours, taking the booking page down for a day costs less than leaving passport uploads on an unpatched server. That is not alarmism — the Dutch House of Representatives and its National Cyber Security Centre took their own sites offline as a precaution ahead of the patch, and the UK’s NCSC alongside CERT-EU advised considering temporary isolation where immediate protection was not possible.
Season arithmetic sets the deadline. Ramadan 2027 is expected around February 8, with Eid al-Fitr around March 9 — both subject to moon sighting — and UK operators see Ramadan umrah enquiries build from November onward, per IslamicFinder’s calendar projections. An agency that finishes LOCK by the end of November enters the enquiry ramp patched, tested and monitored; an agency that leaves it to January is gambling with the busiest six weeks of its year.
C — Check what may already be inside: forms, files and admin accounts
Patching closes the door. It does not evict whoever walked through it earlier — a patch does not remove an existing compromise.
An attacker who got in before October 21 may have left a web shell — a small malicious script planted on a server that lets the attacker run commands long after the original hole was closed. Search Engine Journal’s guidance on this patch is to check for exactly three things afterwards: web shells, unfamiliar admin accounts, and unexpected changes to PHP files.
Then retest the business itself, not just the security. Resubmit every booking form end to end — the enquiry, the deposit reference field, the WhatsApp click-through — because a patched server can still serve a broken form, and a broken form reads to a family like a business that has closed.
The data dimension is where a Manchester agency’s duties sharpen. Scanned passports are personal data under UK GDPR; where a breach is notifiable, the ICO requires reporting within 72 hours of becoming aware, and affected customers must be told without undue delay where the risk to them is high. Agencies selling flight-inclusive umrah packages also operate inside the CAA’s ATOL regime, which makes a breach during booking season a regulatory matter as well as a reputational one — land-only packages sit outside ATOL on their own, but the data duties apply either way.
The cheapest fix in this entire framework is data reduction: stop receiving passport scans by email, collect them in person or through a secure portal, and hold less of what a future breach could expose.
K — Keep watch: the rhythm that holds the season
Hold two habits through the booking season: backups before every update, and a restore test once a quarter. A backup nobody has restored is a hope, not a control.
The pattern repeats across service businesses: a site coasts for years, the season arrives, and the bill lands mid-booking-window. Published UK pricing guides put small-business WordPress care plans at roughly £25 to £150 a month, with most standard plans between £30 and £90 — those figures are agency list prices for updates, backups and monitoring, not media or rebuilds — while a one-off emergency hack cleanup typically runs £300 to £800 depending on severity. Set against each other, one emergency cleanup costs about a year of planned care.
Worked example — substitute your own costs. An agency sells 90 Ramadan umrah packages at an average £2,150 per person; after flights, visas, hotels and ground arrangements the contribution is £210 per booking. A peak booking fortnight produces nine confirmed bookings, or £1,890 of contribution; a Safe Browsing warning or two dead days inside that fortnight erases more contribution than twelve months of a £90 care plan. The assumptions are illustrative, but the comparison they set up — a small monthly control against a season-defining loss — is the decision the numbers exist to frame.
Performance belongs in the same rhythm, because families book on older Androids over patchy signal. Test the site on the slowest phone in the drawer rather than the office laptop; the same lesson runs through why a Frankfurt halal bakery’s Ramadan pre-order shop lost phones, and the mobile-audit method written for Pakistan-market sites transfers directly. Performance engineers make the parallel point about measurement: judge a site against a representative worst case, never a single flattering test.
Maintenance should also include human review of anything AI built. Veracode’s 2025 GenAI Code Security Report found 45 percent of AI-generated code samples failed security tests, as SitePoint’s production checklist reports, and WordPress specialists at Kinsta make the same argument from the other side: AI speeds up the build, and judgment about what belongs on a live booking site still has to be supplied by someone accountable for it.
The LOCK order at a glance
| Before the alert | After LOCK |
|---|---|
| PHP version unknown, or 8.1 and end-of-life | 8.2.35 or newer, confirmed in writing |
| Booking forms untested after changes | Resubmitted end to end, results kept |
| Passport scans arriving by email | Collected in person or via a secure portal |
| No backups, no monitoring | Daily backups, uptime alerts, quarterly restore test |
| Panic cleanup at £300 to £800 | Planned care at £30 to £90 a month |
The four moves compress into one sentence: find the version, ticket the host, retest the bookings, then keep watch to Ramadan.
Key Takeaways
- Locate first: Site Health shows the PHP version in two minutes, and the patched releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- A written patch date from the host within 48 hours is a reasonable demand; a firewall is a bridge while the ticket waits, never the fix.
- After patching, check web shells, unfamiliar admins and changed files — a patch does not remove an existing compromise.
- Passport scans trigger real UK duties: ICO notification within 72 hours where a breach is notifiable, and customers told without undue delay at high risk.
- Finish before December: Ramadan 2027 enquiries build from November, and planned care at £30 to £90 a month costs a fraction of one £300 to £800 emergency.
Read next: what website maintenance actually costs — written for PKR budgets, but the line-by-line method transfers to a GBP care-plan comparison.
At WeProms Digital, we have worked with WordPress sites for service businesses across the UK and the Gulf, and security triage of exactly this kind is what our WordPress security and malware removal service runs on — patch verification, compromise sweeps, booking-form retests and the monitoring handover that follows. The retainer version lives in our website maintenance and technical support plan, which holds the backups, update rhythm and restore tests through booking season. Reach us on WhatsApp +92 300 0133399 or through weproms.com/contact-us; we reply in UK business hours.
Frequently Asked Questions
Is my umrah agency’s WordPress site actually at risk from this PHP flaw?
If it serves pages on an unpatched PHP version, yes. The php2shell flaws affect every PHP release back to 5.4, and Wiz demonstrated unauthenticated takeover on standard WordPress deployments. Check Tools, Site Health, Info, Server in the WordPress dashboard; anything below the October 21, 2026 patched releases — 8.2.35, 8.3.36, 8.4.27, 8.5.12 — is exposed until the host patches it.
We sell umrah packages with flights from the UK — does ATOL change what we do after a hack?
ATOL governs how flight-inclusive packages are sold, and a serious incident during booking season can put that scheme under scrutiny alongside the data questions. The immediate duties after a suspected data breach come from UK GDPR regardless of ATOL: assess, notify the ICO within 72 hours where notifiable, and tell affected customers without undue delay where the risk to them is high.
What do we tell customers if their passport scans were exposed?
First, establish facts — what was exposed, when, and for whom — before writing anything. If the breach is notifiable, the ICO report is due within 72 hours of awareness, and affected individuals are told directly where the risk is high. Keep the message plain, in English and Urdu where that helps, and never speculate about scope in the first message.
How far before Ramadan 2027 does the website need to be ready?
Ramadan 2027 is expected to begin around February 8, 2027, subject to moon sighting, with Eid al-Fitr around March 9. UK umrah enquiries build from November, so the practical deadline is the end of November: patched, retested, backed up and monitored before the enquiry ramp, not during it.
Can WeProms patch and monitor the site for us?
Yes. WeProms Digital runs the full LOCK sequence as a service — version check, host escalation in your name, compromise sweep, booking-form retests — and hands over or holds the monitoring under our WordPress security and maintenance plans. Message us on WhatsApp or through the contact page; the first response, including a read on your current PHP version, can happen the same week.
About WeProms Digital
WeProms Digital is a Lahore-based website security and maintenance agency working with overseas Pakistani and halal-minded business owners across London, Birmingham, Manchester, Dubai, Riyadh, Toronto, Houston, and beyond.
The team specializes in WordPress security, malware removal and ongoing website maintenance, with a track record of putting booking and enquiry sites under daily backup and monitoring without the owner lifting a finger after handover.
Get in touch: hello@weproms.com · WhatsApp +92 300 0133399 (replies in UK and Gulf business hours) · weproms.com/contact-us
Sources & References
- Search Engine Journal — Critical PHP Core Security Flaws Affect Websites, Including WordPress — October 21, 2026
- Wiz Research — PHP2Shell: AI uncovers critical RCE in PHP — October 21, 2026
- Cloudflare Blog — Cloudflare deploys protections against php2shell vulnerability — October 21, 2026
- ICO — Personal data breaches: a guide — accessed October 2026
- UK Civil Aviation Authority — Do I need an ATOL? — accessed October 2026
- W3Techs — Usage statistics of content management systems, WordPress — October 2026
- SitePoint — Vibe Coding to Production: A Developer’s Checklist for Building Reliable Web Apps — October 21, 2026
- IslamicFinder — Islamic Calendar, Ramadan 1448 (2027) expected dates — accessed October 2026
Additional reading from industry feeds:
- Cloudflare Blog — Introducing full transaction detection for Cloudflare WAF — October 21, 2026
- Kinsta — Why WordPress expertise still matters in AI-assisted development — October 20, 2026
- CSS Wizardry — Performance budgets need a representative worst — October 21, 2026
- SitePoint — 9 browser-based checks that make design-to-development handoffs more reliable — October 20, 2026
