PHP Security Vulnerability: What It Means for Your Website
On 21 October 2026, the PHP team released urgent fixes for two critical security flaws in PHP, the software WordPress runs on. Attackers are already using them, so if your website runs on an older version of PHP, now is the time to act.
What happened?
The flaws could let an attacker take control of a website’s server without a username or password. That could mean a hacked site, stolen data, or your site being used to send spam. [more information from Cyberdaily.au]
Because the problem is in PHP itself, it is not the fault of your website or anything you have done but unfortunately it can affect any WordPress site, however well it’s built.
Is my website at risk?
| PHP version | Risk |
|---|---|
| 8.3 and above | Low, once your host applies the fix |
| 8.2 | Medium, as support ends soon |
| 7.4 to 8.1 | High, as these are no longer supported |
| 5.x to 7.3 | Very high, with no fixes available |
If your site is more than a few years old, or hasn’t been looked after in a while, it’s likely on an older version and at a higher risk.
Recommended actions
- Back up your website. Always have a full, recent backup before changing anything.
- Check your PHP version. You’ll find it in your hosting control panel (usually cPanel), or your host can tell you.
- Upgrade PHP. Move to PHP 8.3 or above if your site supports it.
- Test your website. Check that pages load, and any online shop or booking features still work.
- Update WordPress, themes and plugins. Bring everything up to date so it works safely with the newer PHP.
- Remove anything you don’t use. Delete inactive plugins and themes, as they can still be a security risk.
- Keep it up to date. Make updates a regular habit, or have someone look after them for you.
How we can help
- PHP upgrade and testing: $55
- WordPress Care Package (once-off): $245, covering the PHP upgrade plus WordPress, theme and plugin updates, security scans and a backup (includes the PHP updates and testing)
- Ongoing Care Package: up to $195 per service, depending on frequency (includes the PHP updates and testing)
We upgrade your site to the newest version of PHP it can run on, ideally 8.3 or above, then test it. If anything breaks, we roll back to the most recent version that works, so your site stays live.
Some older websites simply can’t run on newer PHP. If yours can’t reach 8.3, we’ll let you know and won’t go ahead with further WordPress updates, as these could cause more problems than they solve and we can discuss long-term options for your website. Only the PHP upgrade fee would apply in these situations.
