Websites
Critical PHP Security Alert: What Business Owners Should Do
Many websites run on a piece of software called PHP. On October 21, 2026, its makers released an urgent fix for two serious security problems. If your website uses PHP, this matters to you.
You do not need to understand the technical details. Here is what you need to know and do.
What happened
The PHP team found two serious problems. In the worst case, a stranger could take control of the computer that runs your website, without needing a password. The fix is out, and updating is the only complete fix.
Governments are taking this seriously. The UK's cyber security agency told organisations to act straight away.
Does this affect my website?
Probably, yes. This is not only a WordPress problem. It affects any website built on PHP. WordPress says no WordPress update is needed. What needs updating is the software on the computer that hosts your website.
Not sure? Ask whoever built your website or your hosting company: "Does my website use PHP, and has it been updated?"
What to do today
- Ask your hosting company. Many hosts update this for you. Ask them to confirm it is done.
- Check the version. On WordPress, go to Tools, then Site Health, then Info, then Server. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, as listed in the PHP team's notice.
- Ask about old versions. Version 8.1 and older no longer get fixes from the PHP team. Ask your host to move you to a newer one.
- Back up your website. Do this before any update, just in case.
- Watch for odd things. Strange pages, new users you do not know, or customers saying your site sends spam are warning signs. Tell your website person at once.
If your website is on very old software and you cannot update it right away, security agencies say to consider taking it offline until it is fixed. A day offline is better than a website that someone else controls.
Why this is a good reminder
A website is like a shop. It needs a lock, and the lock needs fixing now and then. This is why Website Care is one of our services. We keep your website up to date, safe and fast, so you can focus on your business.
Not sure where your website stands? Ask us for a free quote and we will check it and tell you honestly.
Questions about this topic
Do I need to update WordPress?
No. WordPress says no update is planned for this. The update is for PHP on your hosting.
Is my website already hacked?
Not necessarily. This is a warning to update, not a sign that your site was attacked. If you see strange pages or spam, tell your website person.