A PHP security update fixed two critical flaws on Oct. 21. Here is how to check your website

A PHP security update released on Oct. 21 fixes two critical flaws that can let an attacker take over a website’s server with a single web request, no password needed. PHP runs a large share of the web, including every WordPress site, so if you run a blog, shop or business site, this is the update to check for today.

What the PHP security update fixes

The PHP security team warned on Oct. 20 that a release was coming, and shipped it on Oct. 21. Each flaw scored 9.2 out of 10 on the standard severity scale, which is critical.

According to PHP’s own advisory, the first flaw is triggered by sending a server an oddly built form upload that makes PHP run out of memory at the wrong moment. That can let an attacker run their own code on the server, without logging in. The PHP team says it was shown working against a common setup with default settings.

In plain terms: a stranger would not need your password or a hole in one of your plugins. If your server runs an old PHP version, the weak spot is in PHP itself, underneath WordPress and everything else.

Which PHP versions are safe

• PHP 8.5: safe on 8.5.12 or newer
• PHP 8.4: safe on 8.4.27 or newer
• PHP 8.3: safe on 8.3.36 or newer
• PHP 8.2: safe on 8.2.35 or newer
• PHP 8.1, 8.0, 7.4 and older: no longer supported, and PHP is not releasing fixes for them. Some hosting platforms, including cPanel and CloudLinux, have shipped their own patched builds, but most site owners should move to PHP 8.3 or newer.

A quick way to read it: the first two numbers tell you the branch, and the last number has to be at least the one above. A site on 8.3.36 is fixed. A site on 8.3.30 is exposed, unless your host patched it without changing the number, which many hosts do.

How to check your website after the PHP security update

1. Find your PHP version. In WordPress, open your dashboard and go to Tools, then Site Health, then the Info tab, then Server. The PHP version is listed there. On other platforms, your hosting control panel usually shows it under a PHP or software settings page.
2. Compare it with the list above. If your number is equal to or higher than the fixed version for your branch, you are covered.
3. If it is lower, ask your host before you panic. Many hosts patch PHP for you, and some apply the fix without changing the version number, so a lower number does not always mean you are exposed. Hosts do not all patch on the same day, though. In your control panel, look for a PHP version setting and pick the newest patched version. On shared hosting, open a support ticket and ask: “Has my server been updated to the Oct. 21 PHP security release?”
4. Back up before a big jump. Moving from PHP 8.3.30 to 8.3.36 is a small step. Moving from 8.1 to 8.3 is bigger and can break old plugins, so take a full backup first and test the site after.
5. Check for anything odd. Look for admin users you did not create, new plugins you did not install, or pages that redirect visitors elsewhere. If you see any, change your passwords and ask your host to scan the site.

The UK National Cyber Security Centre says anyone who cannot update or apply the PHP team’s temporary fixes should “consider taking the system offline until it can be fully mitigated”. For a small business site, that can mean switching on a maintenance page for a day while your host updates the server.

Why your host matters here

If you pay for managed WordPress hosting, the host usually handles PHP updates, and many will have patched already. If you run your own server or a cheap shared plan, you may be the one who has to click update. Either way, it is worth five minutes today to confirm, rather than assume.

While you are in your dashboard, it is a good time to lock down the rest of the site. Turn on two-factor authentication for every admin account, and check whether your admin email was in a data breach. If you also own your domain name, see what site owners should check after a domain hijack.