In short: on 21 October, two serious security flaws were found in PHP, the software most WordPress websites run on. A fix is out, but it has to be applied by whoever hosts your site. If your site runs on an older version of PHP, the next flaw may not get a fix at all.

What happened

You may have seen this in the news. PHP is the software behind the scenes that powers WordPress and millions of other websites. Researchers found two flaws in it that could let someone take over a website’s server without needing a password. Security experts have called it one of the most serious problems of its kind in years.

A fix was released on the afternoon of 21 October. Since then, hosts and agencies have been working to get it onto every server before anyone can take advantage.

What it means for your website

If your website runs on WordPress, or anything else built with PHP, it was exposed until your host applied the fix. Updating WordPress or your plugins doesn’t help, because the fix happens on the server itself. If you’re with a managed host, they should have applied it already. It’s worth asking them to confirm.

If your site doesn’t use PHP, for example one built on Next.js and hosted on Vercel, it wasn’t affected.

What we did for our clients

On the day the fix came out, we told each of our clients whether their site was affected and what was being done about it.

For sites hosted with WP Engine, the fix was applied to their servers, with extra protection put in front of every site while it rolled out. We were in touch with WP Engine throughout. [For client sites hosted elsewhere, we checked each one and applied the fix. Confirm before publishing.] Clients with sites on Next.js and Vercel heard the same day that they were in the clear.

None of our clients needed to do anything. We’ve been scanning their sites since and keeping a close eye on them. So far we’ve seen nothing to suggest any site we look after has been affected.

What comes next

Each version of PHP gets security fixes for a set number of years, and then they stop. It’s a bit like a car that’s out of warranty: it still runs, but nobody fixes it when something goes wrong.

PHP 8.2, which a lot of WordPress sites still run on, stops getting fixes on 31 December 2026. It got a fix this time. If a similar flaw turns up in January, it won’t.

If your site is on PHP 8.2 or older, plan an upgrade now. We recommend going straight to PHP 8.4, which is covered until the end of 2028, so you’re not doing the same job again next year. Test the upgrade on a copy of your site first, because older plugins can break on newer versions. The older the site, the more there usually is to check.

What you can do

  • Find out which version of PHP your site uses. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section.
  • Ask your host or developer whether the PHP fix has been applied, and when.
  • Delete old test or staging copies of your site that nobody uses. They run PHP too and are easy to forget.
  • Be wary of unexpected emails asking you to reset a password, verify an account or log in. Scammers use news like this as cover. Go to the website directly instead of clicking the link.
  • Look out for anything odd on your site, such as pages you didn’t create or admin users you don’t recognise.

Do you know what your website is built on?

When news like this breaks, the first question is whether it affects you. To answer it, you need to know what your site runs on: which version of PHP, who hosts it, and which plugins it uses. If you can’t find that out quickly, you can’t tell whether you’re exposed, and you’re relying on someone else to notice.

That’s why we built the Tech Stack and Architecture Diagram features into our client platform. They come as standard for every Websure client. They show what each site is built on and how the parts connect, so clients can check the details whenever they need to. We keep that information up to date as part of looking after the site.

Not sure what your site is built on, or whether it’s vulnerable? Get in touch and we’ll take a look.

Sources: Help Net Security, 21 Oct 2026 · PHP supported versions · WP Engine status