If you own a business website, there’s a recent security update you should know about.
On 21 October 2026, the team behind PHP released emergency security updates to fix two critical vulnerabilities. Both were rated 9.2 out of 10 for severity, and could allow attackers to run malicious code on affected servers.
That sounds worrying, but don’t panic. The important thing is to make sure your website is protected and the necessary updates have been applied.
Here’s what you need to know.
What is PHP, and why does it matter?
PHP is a programming language that runs behind the scenes of many websites, including WordPress.
Think of your website as a house. WordPress is the part you interact with – the pages, images, menus and content. PHP is part of the infrastructure that helps everything work.
Like any software, PHP needs occasional updates to fix bugs, improve performance and address security vulnerabilities.
When a serious vulnerability is discovered, installing the appropriate security update is essential to help protect websites from potential attacks.
What happened in October 2026?
The PHP development team announced two critical security vulnerabilities on 20 October, with fixes released the following day.
The vulnerabilities could allow attackers to execute code on affected servers without needing to log in first.
In simple terms, this could potentially give an attacker the ability to run malicious instructions on a vulnerable server. The consequences would depend on the server and the environment, but the risks could include compromising a website or accessing information handled by the affected system.
The vulnerabilities affect PHP itself, rather than being specific to WordPress.
That means updating your WordPress plugins and themes alone will not necessarily address the problem.
The PHP team has released corrected versions, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
You can read the official announcement on the PHP website.
Does this mean my WordPress website is at risk?
Potentially, yes but it depends on the PHP version your website is running and how your hosting environment is configured.
WordPress relies on PHP, so websites using WordPress may be affected by vulnerabilities in the underlying PHP software.
The good news is that fixes are available. The priority is to establish whether your hosting provider has applied the relevant security updates.
You don’t need to understand the technical details or update PHP yourself. In most cases, this is something your web host or website maintenance provider can check for you.
What should you do now?
There are three simple steps you can take.
1. Contact your web host
Ask your hosting provider whether your website’s PHP environment was affected by the vulnerabilities announced on 20 October and whether the necessary security patches have been applied.
If your host manages PHP updates automatically, they may already have taken care of this.
However, it’s worth checking rather than assuming.
2. Check who looks after your website
Your hosting provider and your website maintenance provider may be two different companies.
Your host manages the server environment, while a website maintenance provider may look after WordPress itself, including plugins, themes, backups and general updates.
If you’re unsure who is responsible for what, ask. The important thing is to make sure somebody is taking responsibility for the security of your website.
3. Make sure your website is being maintained
Security updates are just one part of keeping a website safe.
Regular maintenance should also include keeping WordPress, plugins and themes up to date, maintaining reliable backups and checking that your website continues to work as expected.
It’s also worth checking that your website is running a supported PHP version. PHP 8.2, for example, is due to reach the end of its security support on 31 December 2026, so websites still using it will need a plan to move to a supported version.
Updates should be handled carefully, with appropriate backups and compatibility checks, to reduce the risk of something breaking.
Is your website being looked after?
It’s easy to forget about your website once it’s live. But the technology behind it continues to change, and security updates are an important part of keeping it running safely.
You don’t need to become a technical expert. You just need to know that your website is being looked after by someone who understands what needs to be done.
At Lens Digital, we help businesses with WordPress website support and maintenance, including updates and ongoing care.
If you’re not sure whether your website is up to date, or you have a list of WordPress jobs you’ve been meaning to get around to, get in touch with Lens Digital.
A quick check now could help you avoid a much bigger headache later.
