Hi there,
Most business owners I talk to have two companies behind their website. One built it. Another hosts it. And each one quietly assumes the other is handling the updates nobody sees.
Last week showed why that gap matters.
On October 21, the team behind PHP, the software that runs underneath WordPress and many other business websites, announced two serious security flaws and released a fix the same day. Amazon's security team had already seen an attempt to exploit them on October 17, four days before the announcement, and saw more attempts on October 21, the day the fix came out. On October 26, the U.S. government's cybersecurity agency added both flaws to its list of flaws attackers are actively using.
Here is the part that catches owners off guard. That fix does not show up as a button in your WordPress dashboard. Updating WordPress, your theme or your plugins does not apply it. Whoever runs your server has to install it. And about a third of WordPress sites (33.2%, per WordPress.org's own figures this week) run on versions the PHP team no longer updates.
Why this matters now: these flaws let someone on the internet run their own commands on your website's server, no password needed, and attackers are already using them on servers that haven't been updated. If someone gets in, here is what that can look like:
The website goes down. Either it stops loading, or your host shuts it off until it's cleaned up.
Google warns people away. Hidden spam pages or malware on the site can bring up Google's red warning screen before your site loads, and your pages can drop out of search results.
Customer information is exposed. Details people typed into your forms or checkout can end up in the wrong hands.
Cleaning up a hacked site can take days. If Google puts up a warning, it can stay up until the site is fixed and Google checks it again. Black Friday is November 27. The last thing you want is to find out in your busiest weeks that nobody installed the fix.
Giphy
Your 60-second check: send one email to whoever hosts or maintains your site and ask two questions:
Has last week's server security update been applied to our site?
Who is responsible for the next one?
If it has not been applied, ask them to apply it. A partial workaround is not a fix: the PHP team said installing the update is the only safe choice. If your site is on a version that no longer gets updates, ask whether they have applied the special fix some hosts offer for older versions, and ask for a date to move to a current one.
If you want to forward something to your host, this line covers it: "Please confirm our server is running the October 21, 2026 PHP security release for our current version: 8.5.12 or newer, 8.4.27 or newer, 8.3.36 or newer, or 8.2.35 or newer."
Too busy, don't know how, or don't want to deal with it yourself? We can help.
We build on WordPress and on Cloudflare. When your team edits pages every week, we build on WordPress, keep WordPress, its theme and plugins updated, and coordinate server updates with your host. When you would rather not carry that upkeep, we increasingly build on Cloudflare, where there is no server software of this kind for you to keep updated, and pages load fast on a phone. Either way, you talk directly to the specialists doing the work.
Our free website review looks at five things: how easily customers can reach you, how fast your pages load on a phone, how easy you are to find, whether updates, backups, and logins are under control, and whether your tracking works. You get the report by email, then one of our specialists walks you through what to fix first on a 15-minute call.
No passwords needed, and you keep the findings whether or not you work with us.
-Iulia
ScaledOn
