Basis: CERT-EU’s advisory on two PHP flaws rated 9.2, as reported by PPC Land on October 21, 2026, and Google Search Central’s guidance on status codes during maintenance. This is not security or legal advice.
Before you patch
- Find your PHP version (hosting panel or your developer). Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and source backports exist for 7.4, 8.0 and 8.1.
- Check whether your host has already patched, and ask for confirmation in writing.
- Take a backup of files and the database.
If you must take the site offline
- Serve a 503 status code with a Retry-After header, not a 404 or a 200 page that says “error”. Google says a 404 can remove indexed URLs.
- Keep the downtime short: neither Google nor CERT-EU gives a time limit for how long a 503 keeps pages indexed.
After you patch
- Confirm pages return 200 and check key landing pages.
- Watch Search Console crawl stats and coverage for a few days; crawl rate recovers gradually.
- Do not rely on a firewall alone: Cloudflare itself says customers should patch their PHP.
- Look for unexpected files or admin users, since attacks were reported as likely.