You may have seen news headlines about two critical security vulnerabilities discovered in PHP, the programming language that runs behind the scenes on many websites.
And perhaps you are wondering if it applies to your website? Well the short answer is if your site is using WordPress, then it does apply, as WordPress runs on PHP. Other content management systems like Drupal and Joomla also use PHP.
PHP helps a web server build the pages and features visitors see. The vulnerabilities were in PHP itself, not in WordPress. The PHP project released security updates on 21 October to fix them. See PHP: News Archive – 2026. Once these updates were released, web hosting providers rushed to update their systems.
PHP is estimated to power around 70% of websites worldwide, so the flaws affected a large part of the web. If an attacker exploited a server that had not been patched, they could potentially run harmful code on it. That might allow them to access or change information, damage website files, or disrupt a site. The vulnerabilities were rated critical.
If your website is hosted with Web Matters
I can confirm that the suppliers I use for my clients’ web hosting applied the PHP security patches very quickly. They also took steps to protect sites while the updates were being prepared. So you are protected.
If your website is hosted elsewhere
I recommend that you check with your hosting company that the PHP version running your site has been patched against these vulnerabilities. They may well have already sent you an email, or there may be a notice posted to their support page. If you can’t find any notices or emails about updates, put in a support request with your host.
If your site is on a version of PHP below 8.2, I recommend moving to at least 8.2 for PHP. Please note, that in some instances upgrading from older versions of PHP can break sites, if the sites have not been kept up to date or use old code.
How to check which PHP version your WordPress site is using:
- Log in to WordPress.
- Go to Tools → Site Health.
- Select the Info tab.
- Open the Server section and look for PHP version.
This check tells you the version your site is running, but it won’t confirm whether your hosting company has applied the security fix. Note that some hosts have applied the fix to older PHP versions that are no longer officially supported – so you still may be protected – but don’t assume so. You really want to move your PHP to a more recent version.
If you prefer, you can ask me to follow up with your hosting company on your behalf. If you’re a new client looking for help with your WordPress site or hosting, you’re welcome to get in touch.
