Critical PHP security updates are out: why staying current matters

On October 21, the PHP project released security updates for two critical flaws. PHP is the programming language WordPress runs on, so this affected nearly every WordPress site out there. Every client site we manage has now been updated.

What happened

• PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• According to the PHP announcement, the two flaws could let an attacker run their own code on a server without logging in.
• The PHP team says there’s no complete workaround. Updating is the only safe fix.
• PHP 8.2 stops getting updates at the end of 2026. PHP 8.1 and older no longer get updates from the PHP project at all.

What we did

• We host and manage our clients’ websites, so we took care of the PHP update ourselves. It was applied within 15 minutes of its release. Nobody had to wait on a third party.
• As an extra precaution, we added Cloudflare protection the day before the release. It’s a good extra layer, but it doesn’t replace the update, so we installed the update anyway.
• We confirmed the updates were in place on every client site.
• Clients didn’t have to do anything.

It’s not just PHP

Your website is built in layers: the server software (including PHP), WordPress itself, your theme and every plugin. Each layer has its own team and its own release schedule. Security fixes can land on any day, including weekends and holidays. Attackers read the same announcements we do, and a new fix can show them exactly where to look.

What doing it yourself looks like

Most business owners can’t act within minutes. They’d have to find out about the release first. Then the work looks like this:

1. Follow the release news for PHP, WordPress, your theme and every plugin.
2. Work out which updates apply to your site and how urgent each one is.
3. Make a backup first.
4. Apply the updates in the right order. Some, like PHP, need server access.
5. Test your forms, your key pages and anything that takes payments.
6. Undo the update if something breaks.
7. Repeat next week.

If that sounds like a fun hobby, great. For most business owners it’s a job that slides to the bottom of the list, and nothing seems to go wrong until it does. Depending on your host, PHP updates may be yours to handle, or they may not happen at all.

How our Website Management handles it

This is what that looked like in practice this week. Our Website Management Plans take this off your plate so you can continue to focus on your business:

• 24-hour critical security updates
• Weekly maintenance and bug fixes
• Daily file and database backups
• 24/7 uptime monitoring
• Multi-layer security and managed hosting
• A monthly report showing what was done

You don’t need to follow the news or run the updates. We do.

Questions to ask your webmaster

• What version of PHP is my site running, and is it still supported?
• Who watches for security releases, and how fast do critical fixes go out?
• Are there recent backups I can restore from?
• Are my theme and plugins updated regularly? Are any of them abandoned?
• Would anyone notice if my site went down tonight?

If you can’t answer these, or you’d rather not have to, send me a message. I’ll give you an honest answer about where your site stands. For more on why updates matter, see why it’s important to keep your website updated.