PHP Critical Security Update: Your Site Is Already Protected

A critical PHP security update was implemented this morning.  This morning, the PHP project released emergency fixes for two critical security flaws that affect a huge share of the websites on the internet, including WordPress sites. The good news: the servers hosting your website were patched within about an hour of the fix being released. You don’t need to do anything.

I want to explain what happened, why it mattered, and how your site was protected, because it’s a clear example of how quickly website security moves today.

What is PHP?

PHP is the programming language WordPress is written in. It runs on the web server, and every time someone visits a page on your site, PHP builds that page and sends it to their browser.

If WordPress is the engine of your website, PHP is the fuel system feeding it. You never see it, but nothing works without it. That’s why a security flaw in PHP is serious: it sits underneath WordPress, your theme, and every plugin, so even a perfectly maintained website can be exposed if the PHP running it is vulnerable.

What happened

On October 21, PHP released security updates fixing two flaws, together nicknamed “PHP2Shell.” According to PHP’s announcement, both are rated 9.2 out of 10 for severity and could let an attacker run their own code on a web server without logging in. In plain terms, someone could take control of a website from the outside.

A few things made this one especially urgent:

• It was widespread. According to security firm Sansec, the flawed code dates back to 2012 and affects servers running PHP in their default setup.
• Details leaked early. Information about the flaws became public on October 20, a day before the official fix was ready.
• Attacks started before the fix. Sansec reports that Cloudflare saw early attack attempts about six hours before PHP released its patch.
• Older PHP versions get no fix. PHP only provides updates for version 8.2 and newer. Sites still running older versions remain exposed unless they’re upgraded.

This is a growing pattern in website security: problems are discovered, publicized, and attacked faster than ever, often within hours.

How your site was protected

Protection started before the fix even existed. My hosting partner, InMotion Hosting, posted an advisory as soon as PHP gave advance notice of the release, and took precautions in the meantime:

• They switched off a PHP feature tied to one of the flaws. InMotion’s systems team disabled PHP’s upload-progress setting on the servers it manages. This closed off one route attackers could use while everyone waited for the official patch.
• They made sure it wouldn’t disrupt sites. The setting only powers a specific kind of upload progress bar that most sites don’t use, so normal visitors and forms were unaffected. Uploads still worked.
• They were clear it was a stopgap. InMotion stated the precaution reduced exposure but did not replace the patch, and planned to deploy patched PHP as soon as it was released.

PHP published its fixes at 7:00 a.m. Pacific time. The server hosting your website was running the patched version within about an hour.

There’s one more piece. Last week, I moved most of the sites I host to newer, fully supported versions of PHP. That timing turned out to matter: today’s fix only covers PHP 8.2 and newer, so sites on older versions would have stayed exposed no matter how fast the server was patched. Because that groundwork was already done, those sites were ready to receive the fix the moment it arrived.

That speed matters. With attacks already underway before the fix existed, every hour a server stayed unpatched was an hour of real exposure. Fast patching at the server level closed that window almost as soon as it was possible to close it.

This is part of what you get with hosting that’s actively managed rather than simply rented: someone is watching for these announcements and acting on them immediately, often before most people have even heard the news.

What this means for you

If I host your website, you don’t need to take any action for this update. Your site is running on a patched server.

It’s still a good reminder of something I’ll cover in my next post: the server is only one layer of protection. PHP was fixed at the server level today, but the WordPress software, themes, and plugins on your site need their own regular updates and care. As security issues arrive faster and more often, keeping every layer current is becoming one of the most important things you can do for your website.

If you have questions about your site’s security, I’m always happy to talk.

Sources

• PHP, release announcements, October 21, 2026
• Sansec, PHP2Shell: Critical PHP RCE
• InMotion Hosting, PHP Security Release: Critical Patch Due October 21