Hi,
This one is off schedule, and short.
Two critical security flaws in PHP went public this week. PHP is the software WordPress runs on. So if your website runs on WordPress, it runs on PHP.
If that's you, update it immediately, or take the site down until it's updated.
From NBC News coverage this week.
The coverage, if you want to read it yourself:
Today I checked a business website that was still running PHP 7.4. That version stopped getting security fixes in November 2022.
If you don't know which version your site runs, here's how to find out and fix it:
Back up the site. Most hosting accounts have a backup button. Do this first.
Find your PHP version. Log in to your hosting account (the company you pay for the website) and look for a setting called "PHP version" or "PHP manager."
Check it against the fixed versions. The fixes shipped on October 21 as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything lower needs updating. If yours starts with 7, or is 8.0 or 8.1, the PHP project doesn't fix it at all anymore.
Update PHP, or ask your host to. If you can't find the setting, send your host's support team this: "Is my site on one of the PHP versions released October 21, 2026 (8.5.12, 8.4.27, 8.3.36 or 8.2.35)? If not, please update it."
Update WordPress, your theme and your plugins. In your WordPress dashboard, go to Dashboard, then Updates.
Open your site and click around. Load a few pages, and try any contact form or checkout. If something broke, restore the backup and call your host.
If you can't get this done today, put the site in maintenance mode or take it offline until you can. That's what the UK's cybersecurity agency recommends too.
Just wanted to let you know.
Marc
Some of this content was made with AI assistance. Writing, creative direction, and final decisions are human.