SEO this week: urgent PHP patch, Google targets platform spam, AI Overviews at 80%

This week SEO started with security. A critical flaw in PHP, which runs most WordPress sites, pushed many owners into emergency updates or short shutdowns. At the same time Google tightened its guidance on user-created pages, and AI Overviews now appear on more searches than ever. Here is what you need to know.

Critical PHP flaws: update now

On 21 October the PHP project warned of two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that can let attackers run code on the server. Every PHP installation serving web requests is at risk. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get project releases, so you need a patch from your host or a move to a supported version. The PHP team says interim settings reduce the risk but do not make a site safe. Only updating does.

How to take a site down without losing rankings

The same day, Google's John Mueller advised that a site taken offline for patching should return HTTP 503, not a 404, a 500 or a timeout. Ideally this is done outside PHP, for example through DNS or a CDN. Google's documentation on pausing a site adds that a 503 suits closures of one to two days, with a retry-after header, and that a full shutdown should last a few days at most. Your robots.txt must not return a 503, because that blocks all crawling.

Google: user-created pages do not belong in Search by default

On 26 October Google expanded its guide on user-generated spam. Platforms where users create shared pages, generated content or web apps should decide what is meant for Search. Pages made for sharing, collaboration or as tools should be noindex by default or blocked in robots.txt. Google also recommends watching the Search Console indexing and performance reports for sudden spikes in indexed pages, impressions or queries. WordPress is named as an example, so this also applies to sites with open comments and forms.

On 23 October Google also restated in its documentation that words in URLs should be separated with hyphens (-), not underscores (_).

AI Overviews on over 80% of searches, rankings restless

On 26 October Search Engine Roundtable reported, based on data from Semrush, SE Ranking and seoClarity, that AI Overviews now appear on over 80% of Google searches. SE Ranking measures 82.5% for US brand searches, seoClarity over 62% of queries. The sources measure different things, so 80% is a rough figure. On 24 October rank trackers recorded strong ranking swings. Google has confirmed nothing, and its status dashboard lists no new update since the September spam update.

Google Business Home in closed testing

Google is testing Business Home, a new dashboard built with Gemini models that connects Business Profile, Google Ads, Merchant Center and YouTube. For now it is a closed beta for selected business categories in the US and UK, by invitation only.

What it means for your business

1. Check your PHP version today. Ask your host whether the server runs 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you must take the site offline, return a 503 and keep it short.
2. Close the doors to spam. If your site has comments, forums or user pages, add noindex where search is not needed and check the Search Console indexing report once a month.
3. Write for AI answers. With AI Overviews on most searches, service pages with clear answers, prices and contact details have the best chance of being cited.

If you want us to check your site's security and visibility, see our SEO service or get in touch.