If your practice website runs on WordPress, there’s a security issue you should know about this week.
On October 21, the team behind PHP, the programming language that powers WordPress and much of the web, released an urgent fix for two critical security flaws. Security firms are urging every website owner to make sure their site has been updated.
The good news: the fix is already available, and for most practices, making sure it’s applied takes one email to your web host. Here’s what happened and exactly what to check.
What Happened
Security researchers found two serious flaws in PHP itself, now nicknamed “PHP2Shell.” According to Help Net Security, these flaws could let attackers run code on a web server without needing to log in.
A few things make this one serious:
- It’s rated critical. Both flaws scored 9.2 out of 10 on the industry’s standard severity scale.
- It’s widespread. Because the flaws are in PHP itself, they affect a very wide range of websites, not one particular plugin or theme. Palo Alto Networks’ Unit 42 team identified more than 22 million publicly exposed systems that were potentially vulnerable.
- Details leaked early. Information about the flaws leaked online on October 20, before a fix was available, and security firm Sansec reported early attack attempts on October 21.
What You Need to Do
You don’t need to become a security expert. You just need to confirm that whoever looks after your website has applied the update.
1. Find Out Who Hosts Your Website
Your web host is the company whose servers your website runs on. It might be your web designer, a marketing agency, or a hosting company you signed up with directly. If you’re not sure, check your monthly invoices or ask whoever built your site.
2. Ask Them One Direct Question
Send your host a short email: “Have you applied the October 21 PHP security update for CVE-2026-109618 and CVE-2026-109619 on the server hosting my website?”
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. A good host should be able to give you a clear yes and a date.
Tip: The PHP team is not releasing fixes for PHP 8.1 or earlier, because those versions are no longer supported. If your site is running an older version, ask your host about upgrading as soon as possible.
3. Ask Whether Your Site Needs a Health Check
If your host wasn’t able to update quickly, ask them to check your site for signs of a problem, such as unfamiliar admin accounts, unexpected redirects, or security warnings from Google. Make sure you have a recent backup of your site too.
4. Check Any Other Websites You Run
Think beyond your main website: an online store, a separate booking or membership site, an old website that was never taken down, or a personal blog. If it runs on WordPress or another PHP-based platform, it needs the same update.
5. Be Wary of “Click Here to Fix It” Emails
Big security news is often followed by scam emails that borrow the headlines. Be cautious with any unexpected message urging you to click a link, download a “patch,” pay for an emergency fix, or share your website or email login.
When in doubt, contact your provider directly using a phone number or email address you already know, not the one in the message.
Quick Checklist
- ☐ I know who hosts my website.
- ☐ My host has confirmed the October 21 PHP update has been applied.
- ☐ My site isn’t running PHP 8.1 or earlier.
- ☐ I have a recent backup of my website.
- ☐ I’ve checked any other websites or tools my practice runs.
- ☐ My team knows not to click links in unexpected “urgent security” emails.
The Bottom Line: One Email Can Close the Gap
This is a serious vulnerability, but the fix is available and straightforward for your host to apply. The most important step is simply confirming it has been done.
If your host can’t give you a clear answer, that tells you something important about who’s looking after your website.