Do I Need to Do Anything About the PHP Security Update?

On October 21, the team that maintains PHP released an urgent security update. If your website runs on WordPress, it runs on PHP, so this one is worth a few minutes of your time.

Here’s what happened, what it means for your site, and how we’re handling it at NgageContent.

First, the good news. If NgageContent hosts or maintains your website, you don’t need to do anything. As of October 23, we have either patched every site under our care or started migrating it to an updated server if it was an older site. If we need access to your DNS as part of that, we will reach out to you.

What Is the October 2026 PHP Security Update?

The PHP security update fixes two serious security flaws in PHP itself. If left unpatched, either flaw could let someone outside your organization take control of the server your website runs on, without needing a password or a login.

This wasn’t caused by anything specific to your site or anything you did. The flaws affect nearly every version of PHP in use today, so a large share of the internet was exposed at the same time, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch immediately. Security researchers have nicknamed the issue “php2shell.”

The timing made it more urgent than most. Details of the flaws leaked a day before the fix was released, attacks were reported hours before the update came out, and working attack code was public within a day.

What Is PHP, and Does It Affect My WordPress Site?

PHP is a widely used technology that works behind the scenes to build your web pages each time someone visits. WordPress is built on it, along with many other website platforms.

So yes. If your site runs on WordPress, it runs on PHP, and this update applies to you.

Is Updating WordPress Enough to Fix It?

No, and this is the most important thing to know about this update. PHP lives on the server that hosts your website, not inside WordPress. Clicking “Update” in your WordPress dashboard won’t touch it.

The fix is to update PHP on the server to a patched version, then restart the server so the update takes effect. Depending on how your site is hosted, that’s your hosting provider’s job, your web team’s job, or both. It’s worth confirming which.

(If you read our post on the July WordPress security update, this is a different issue with a different fix.)

How Do I Check Which PHP Version My Site Uses?

In your WordPress dashboard, go to Tools → Site Health, click the Info tab, and open the Server section. Your PHP version is listed there.

The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your site shows one of these, or a higher number in the same series (for example, 8.3.37), the fix is in place.

If your version is lower, or you’re not sure what you’re looking at, contact your hosting provider or reach out to us. We’re happy to take a look.

What If My Site Runs an Older Version of PHP?

PHP only releases security fixes for version 8.2 and newer. Sites running PHP 8.1, 8.0, 7.x, or older won’t receive this fix at all. The only way to protect them is to move to a supported version.

To be straight with you, that’s more involved than a routine update. Older themes and plugins aren’t always compatible with newer versions of PHP, so the move should be tested on a copy of your site before it goes live. That’s not a reason to wait. It’s a reason to start now and do it carefully.

What Is NgageContent Doing for Our Clients?

As soon as the fix was released, our development team got to work. We checked every site we host and maintain, updated PHP to the patched version, and restarted servers so the fix takes effect.

As of October 23, we’ve either updated every site we host or started the migration process to an updated server.

If your site is on one of our hosting or maintenance plans, you don’t need to do anything. If you notice anything unusual on your site, contact us and we’ll look into it.

Why Does Ongoing Website Maintenance Matter?

This is the second urgent web security issue this year, and the window between a flaw going public and attackers using it keeps shrinking. This time it was measured in hours.

The risk isn’t only a break-in. Hosting providers may take servers showing signs of compromise offline to protect their other customers, which means an unpatched site can also mean a site that’s down.

That’s why we treat website hosting and maintenance as an ongoing responsibility, not a once-a-quarter checklist. Security flaws don’t wait for your next scheduled maintenance window, and neither do we.

What If NgageContent Doesn’t Manage My Site?

Check your PHP version using the steps above, then ask your hosting provider whether they’ve applied the PHP security update and when. Don’t assume it’s been handled. Hosts are rolling out the fix at different speeds, and some older setups don’t have the patched version available yet.

If your host hasn’t patched, or your site needs to move off an older version of PHP and you’d like help doing it safely, reach out to us.