A major security flaw was fixed in PHP on 21 October 2026. It is not a flaw in TOWeb or in your website: it affects web hosts' servers, all over the world. To protect themselves, many hosts will move their customers to a recent version of PHP, version 8.2 or later. Your website needs to be ready to follow: here is how to check, in a few minutes.
What is PHP?
PHP is the technology web hosts install on their servers to run the “active” parts of websites: a contact form that sends you an email, a shop that records an order, comments under a post. You never see it, but almost every web hosting plan uses it.
What is happening
The PHP project only releases fixed versions for the versions it still supports: PHP 8.2 and later. For PHP 7.4, 8.0 and 8.1, it no longer provides updates, only a minimal patch that some hosts will apply themselves and others will not. The lasting solution is therefore to move to PHP 8.2 or later.
Server security is your web host's job, and there is nothing for you to do on that side. However, hosts do not really have a choice: they will move websites still on an old version to PHP 8.2 or later, sometimes without much advance notice.
It is this version change that can affect your website: if your website was published with a version of TOWeb that does not produce scripts designed for PHP 8, some features may stop working overnight.
Is your website affected?
No, if your website is a simple showcase: pages, images and text, with no contact form, no online shop, no blog with comments, no poll, guestbook or members' area. Such a website does not use PHP: your host's version change makes no difference to it.
Yes, if your website uses an i-Service: a form, a shop with online ordering, blog comments, a poll, a guestbook, a members' area… These features rely on PHP scripts that TOWeb publishes with your website, and those scripts must be compatible with your hosting's PHP version.
Which version of TOWeb for PHP 8?
- TOWeb 9 and earlier: the scripts are not designed for PHP 8. On PHP 8 hosting, some features no longer work (for example, poll votes are no longer recorded).
- TOWeb 10 to 13: the scripts were adapted to PHP 8 from version 10, but further fixes followed. For example, with version 10, blog comments may be rejected; up to version 14.08, the shop's order tracking may show a blank page in some cases.
- Up-to-date TOWeb 14 (14.09 or later): the published scripts are suited to current PHP versions (8.2, 8.3, 8.4). Many users have long been using it on PHP 8.3 or later hosting, with every TOWeb feature.
- TOWeb 15: the new generation of TOWeb, entirely rewritten. Its PHP scripts (forms, shop, bookings) are written for current PHP versions, up to PHP 8.5, and also work on hosting still on PHP 7.4.
What should you do?
- Check your hosting's PHP version. It is shown in your web host's customer area (under “PHP”, “Configuration” or “Web hosting”). If your host has announced a move to PHP 8, now is the time to act.
- Check your TOWeb version: it is shown at the top of the welcome screen when TOWeb starts (“TOWeb version 14…”).
- Depending on your case:
- You have TOWeb 14: install the latest version of TOWeb 14 (Windows · macOS), which works with your current licence, then republish your website. The scripts on your hosting are only replaced when you publish.
- You have TOWeb 13 or an older version: move to TOWeb 15, at the upgrade price reserved for TOWeb users. Your TOWeb 15 purchase entitles you, on request, to a TOWeb 14 key for the same edition, so you can carry on with TOWeb 14 until version 15 is finished: write to us with your order number.
- After publishing, test your website: send yourself a message with your form, place a test order, post a comment.
In summary
The flaw is in PHP, not in TOWeb, and your web host takes care of fixing it. On your side, make sure your website is ready for PHP 8: a showcase website has nothing to fear; a website with a form, a shop or a blog must be published with an up-to-date TOWeb 14 or with TOWeb 15.
Discover TOWeb 15 · Pricing and upgrade · All versions of TOWeb