What happened
On 21 October 2026, the PHP project released urgent security fixes for a serious flaw, and the National Cyber Security Centre urged UK organisations to act quickly.
PHP is the language that runs WordPress and a large share of the web. If your organisation has a WordPress website, this one is worth five minutes of your time.
What it means in plain English
The flaw sits in PHP itself, on the server your website runs on. It is not a WordPress bug or a plugin problem, so updating WordPress alone will not fix it.
The fix is a PHP update on the server. That is usually applied by your hosting company, or by whoever manages your server for you.
What to do now
You don’t need to be technical. Three questions will get you most of the way:
- Who hosts our website, and who is responsible for server updates?
- Have they applied the PHP security update released on 21 October?
- Do any of our other systems, such as ticketing, CRM or membership, run on PHP?
The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Sites on PHP 8.1 or older are no longer supported and should be upgraded.
What we did, and the wider lesson
We patched the servers we run on 21 October. For clients whose sites are hosted elsewhere, we checked in with their hosts.
The bigger lesson isn’t about PHP. When something like this lands, the organisations that respond calmly are the ones who already know who manages what: hosting, ownership, maintenance and expert support. That’s the thinking behind HOME, our simple framework for website care. It covers four questions every organisation should be able to answer:
- Hosting: where does our website live, and who keeps the server secure and up to date?
- Ownership: do we own our domain, logins and content, or does someone else hold the keys?
- Maintenance: who updates WordPress, themes and plugins, and how often?
- Expert support: who do we call when something goes wrong, or when we need advice?
If any of those answers is “I’m not sure”, that’s the place to start. In this case, knowing your Hosting answer is what tells you who should be applying the PHP fix.
Need a hand?
If you’re not sure where you stand, or who to ask, get in touch. We’re happy to help, no strings attached. You can also see how we look after WordPress sites for arts and culture organisations at care.chaptr.studio.