Madiha Yaqoob
When a flaw in PHP makes headlines, clients do not call the people who write the code. They call whoever they trust to keep their website alive. If you are a freelancer or run a small agency, the next two weeks are a chance to show that you are that person.
Clients are already hearing about it
The story reached mainstream news fast. Brussels Times reported that Belgian school platforms, media sites, a hospital website and government sites went offline on October 21, some described only as maintenance. The Hacker News reported that BambooHR warned of payroll interruptions and that several Dutch government and education services were pulled as a precaution. Your clients may not follow security feeds, but they read headlines, and a headline about a flaw in a language most of the web uses produces a worried email.
Reply before they ask
The most valuable thing you can send today is a short, calm note to each client whose site you maintain. Say what the issue is in one sentence, say which PHP version their hosting runs, and say what you are doing about it and by when. Clients forgive a problem far more readily than they forgive silence.
What to offer, concretely
Keep the offer small and specific, because worried clients want clarity and not a menu.
- A one-off PHP version audit across every site you look after, with a written result per site.
- Coordinating the host patch or branch upgrade, including a staging test for older plugins.
- A post-patch check of admin users, recent file changes and backups.
For existing retainer clients, fold this into the care you already provide. For one-off clients, a clearly scoped fixed-fee check is easier to say yes to than an open-ended hourly engagement. Set the price based on your own time and risk, not on the fear in the news.
Be careful what you promise
The fix lives at the server level, and on shared hosting you often cannot apply it yourself. Promise what you control: finding the version, escalating to the host with a clear ticket, testing compatibility, and verifying afterwards. Do not promise that a site is safe. The PHP advisory states that only updating is a complete fix, and researchers have reported exploitation attempts since October 21, so honesty about what is and is not covered protects your reputation.
Turn one scare into a standing service
The better outcome is not a one-time audit. It is a quarterly maintenance routine: version checks, update windows, backup tests and a short written report. Clients who saw you respond calmly this week are the easiest to move to a recurring plan, and it gives you steadier income than chasing projects. If you are new to selling services like this, our guides on patching a site step by step make a useful starting point to share with clients.
A short template you can adapt
Subject: Your website and the PHP security update
Hi [Name], you may have seen news about a serious flaw in PHP, the language your site runs on. I have checked your hosting, it runs PHP [version], and I am [asking the host to apply the fix / upgrading to a supported version] and will confirm once it is done. No action is needed from you. I will send a short note when everything is verified.
For the technical background on why old flaws are now becoming working exploits so quickly, read what PHP2Shell says about AI and software security.
