Hey, it's Jeane 👋

No marketing tips this week. This one's a security heads-up, and I'm keeping it short.

What happened

On Wednesday, October 21, the people who maintain PHP put out an emergency fix for two serious security holes. The security world is calling it PHP2Shell.

PHP is the programming language WordPress is built on. It also runs plenty of other things you might use: online stores, booking and membership tools, older custom sites, that one form your developer built in 2019.

Why this one matters

Most website security problems start with a stolen password or a plugin nobody updated. This one doesn't need either. An attacker can go after the server your site sits on without logging in, and if it works, they can run their own code there.

It's rated 9.2 out of 10. Researchers at Wiz showed it working on a plain, out-of-the-box WordPress site. And Amazon's security team saw someone trying it on October 17, four days before the fix came out.

The part most people miss

Updating WordPress won't fix this. Neither will updating your plugins or your security plugin. The fix is in PHP itself, which lives on your hosting server. So this one is on your host, or whoever runs your server.

What to check today

1. Find your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open Server. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some hosts patch without changing the number, so if yours looks older, don't panic. Ask.
2. Ask your host, in writing: "Have you installed the October 21 PHP security update on my server?" You want a clear yes.
3. If you're on PHP 8.1 or older, PHP isn't putting out a fix for those. Back up your site and move to a newer version.
4. Watch for anything odd over the next few weeks: an admin user you didn't create, a plugin you didn't install, strange pages showing up in Google under your business name.
5. Don't forget your other stuff. An old site you never took down, a store on a different server, a custom app. If it runs PHP, the same questions apply.

If you have Cloudflare in front of your site, it started blocking the known attacks about nine hours before the news broke, even on the free plan. That buys you time. It isn't the fix.

A heads-up about your inbox

Big security news is great bait for scammers. Someone on my team forwarded me a "security notice" this morning with the note "I clicked NOTHING! Just in case." Perfect instinct. (That one turned out to be real, but the habit is right.) If an email tells you to "click here to patch your site," don't. Log in to your host yourself instead.

What we did

If you're a Website HQ client, you're covered. We installed the fixed PHP on your site Wednesday, and I checked a batch of client sites this morning to be sure. You'll get a separate note from me.

One date for your calendar

PHP 8.2 stops getting security fixes on December 31, 2026. Most of the sites I checked this morning are on 8.2, so we're planning those upgrades now. If yours is on 8.2 too, do the same, so the next PHP scare doesn't find you on a version nobody's fixing.

Not sure what your host's answer means? Hit reply and paste it in. I'll tell you if it sounds right.

I hope you have an awesome day!
🧡 Jeane
​
PS - This was patched yesterday for Website HQ Site Care Club clients.