Real human. Fast replies.
💬Text me(386) 569-1227
📞Call me(386) 569-1227
✉️Email mechenzo@honesty.im
📝Send a messageI reply same day
On October 21, PHP put out an emergency security release for two critical holes that can let a stranger run code on a web server without logging in. If your site runs on WordPress, that’s you. And here’s the part nobody tells you: clicking “Update” in your WordPress dashboard didn’t fix a thing.
The short version
The PHP project announced a security release on October 20, shipped it on October 21, and called it critical. Both bugs were rated 9.2 on the CVSS scale, which is security nerd for “drop what you’re doing.”
According to the official PHP security advisory, the flaws affect basically every PHP install that serves web pages: PHP-FPM, Apache with mod_php, LiteSpeed, the whole family. The risk is highest on Apache with mod_php, which (fun fact) is exactly the setup a lot of cheap shared hosting has been running since the Obama administration.
PHP listed a few workarounds, then said plainly that they don’t make an installation safe. Only the update does. When the people who make the software say that, I believe them.
No. WordPress is the app. PHP is the engine underneath it that your hosting company installs and maintains. Updating WordPress is like getting a new paint job; it does nothing about the recall on your brakes.
I see this all the time. A business owner tells me their site is “totally up to date” because they clicked every update button in the dashboard, and the server underneath is running a PHP version that stopped getting regular updates years ago. Nobody lied. It’s just that nobody ever told them there was a second layer.
That’s the BS part of how small business websites get sold. You hear about themes and plugins and pretty fonts. Nobody mentions the server, because the server isn’t sexy until it gets hacked.
In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. Your PHP version is right there. Takes about thirty seconds.
Here’s what to look for:
Also worth knowing: PHP 8.2 itself hits end of life on December 31, 2026. So if you’re on 8.2, congratulations, you’re patched and also on the clock.
Send your host one short message: “Is my server on a PHP version that includes the October 21 security fixes?” Make them answer with a version number, not “we take security very seriously.” That sentence has never patched anything.
If you switch PHP versions yourself in cPanel, check that the version you picked is the patched one. Some hosts list “8.3” without telling you which 8.3.
Then, once you’re patched, take a quick look for leftovers. A patch closes the door; it doesn’t kick out anyone who already walked in. Look for admin users you don’t recognize, plugins you didn’t install, and weird PHP files that showed up recently. If that sounds like a pain in the ass, it is, which is why it’s worth having someone who does it for a living.
If you ever need to take the site down while you fix things, Google’s advice this same week was to serve a 503 “Service Unavailable” status instead of letting pages time out or throw random errors. Google’s John Mueller and the Search Central team both said it: a 503 keeps your pages in Google while you work. Just don’t leave it up for more than a day or two, or Google starts wondering if you moved out. The full breakdown of Google’s 503 reminder is worth a read if you manage your own server.
Because the website gets built, launched, and then treated like a billboard. Hang it up, forget it exists. But a website is software running on a computer somewhere, and computers need maintenance whether or not anybody’s looking at them.
Big companies have IT departments that patch this kind of thing the day it drops. Small businesses have a guy named Steve, who set up the hosting in 2018 and now sells boats. (I’m sure Steve is doing great.) The bad guys know this. Automated scanners don’t care if you’re a Fortune 500 or a bait shop; they just look for old PHP and knock.
I wrote earlier this month about keeping WordPress itself patched. This is the same lesson one floor down. Your site is a stack: WordPress, plugins, theme, PHP, the server. Every layer needs a grown up keeping an eye on it.
A security patch inside the same version (say 8.3.30 to 8.3.36) almost never breaks anything. Jumping major versions, like 7.4 to 8.3, can break old plugins and themes, so back up first and test before you flip the switch.
Safer, not safe. A firewall can block some attacks, but if someone can reach your server directly, they skip the firewall entirely. It’s a seatbelt, not a brake job.
Look for unfamiliar admin accounts, plugins or files you didn’t add, sudden redirects to sketchy sites, or Google warnings in Search Console. If anything looks off, have someone run a proper malware scan rather than guessing.
Look, I’m not trying to scare anybody. Most sites will be fine once the host does their job. But “most” is doing a lot of work in that sentence, and finding out the hard way is a damn expensive way to learn what PHP is. If you want someone to check your server, patch it, and keep an eye on the whole stack so you never have to read a post like this again, tell me about your site or see everything I handle.
The outreach Autobot I run for businesses, learning your voice and talking to the right people every day so more of them find you and reach out.
Card adds a 3.5% processing fee ($51.75). Venmo or Zelle is a flat $50.
Venmo @chenzowebguy · $50 · memo CZ-AUTOBOT-STARTER
Zelle 386-569-1227 · $50 · memo CZ-AUTOBOT-STARTER
