Your website has a part you have probably never heard of, and this week it became urgent. It is called PHP, and if your shop, your clinic or your guesthouse has a WordPress site, it is running underneath.
Think of it as the engine in a van you never open the bonnet on. Someone installed it years ago. It has kept the van moving. And this week the manufacturer announced a serious fault.
What happened this week
On 21 October the PHP project released fixes for two serious flaws. According to Simon Willison's write-up of the release, both let an outsider run their own commands on a website's server without logging in, and the fixes cover the whole PHP 8 line. The people who found the first one, a security firm called Wiz, say they used AI models to do it. In August they confirmed it worked against WordPress and Drupal, two of the most common website systems. The Spanish tech site Xataka puts PHP behind roughly 70% of websites.
Then came the messy part. The flaw identifiers leaked on 20 October, a day before the planned announcement, and demonstration code started to circulate. So the usual comfortable gap between "a fix exists" and "someone is using the flaw" is short this time, and nobody can tell you how short.
Why AI makes the gap shorter
Finding a hole in old, enormous software used to take a skilled person weeks. A model can read the same code tirelessly, try thousands of ideas, and check its own guesses. Xataka makes a sharp point: this is less about a brand-new bug than about old flaws that stayed hidden for years and are now cheap to find.
Here is the part that matters for you. Defenders get the same tools, and the fixes arrived. But a fix does nothing until somebody installs it. For a business with four employees and a website a cousin built in 2019, "somebody" is often nobody.
The thing nobody tells you about updates
When WordPress asks you to update, it updates WordPress. It does not update PHP. PHP lives one layer down, on the hosting company's machine, and is changed in the hosting settings or by the hosting company itself.
That is why a site can show "everything up to date" and still be running an old engine. And an old engine from a version the PHP project no longer supports gets no fixes at all, however polite your plugins are.
Three things to do this week
1. Find out who runs the engine. Is it your hosting company, or the freelancer who built the site? If you have a hosting invoice, that company is the starting point.
2. Ask them one question, in writing. Something like: "Which PHP version is my site running, and has it been updated with the security release of 21 October?" A good provider answers in a day. You are allowed to ask.
3. If you run WordPress, peek yourself. In the dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. The PHP version is listed there. Take a screenshot and send it with your question.
If your site is only a brochure, that is genuinely enough for today. If it takes bookings or orders, or holds customer details, also ask whether anyone has looked for anything unusual since 20 October.
What I don't know, and you shouldn't be told either
I have not seen the exact version numbers of the fixed releases, so I will not pretend to give you a number to aim for. Ask the host for the latest security release. I also cannot tell you how many sites have been attacked, and Xataka says nobody can yet. Plenty of hosting companies patch centrally and will have done this already without telling you. And no checklist can promise your site is clean. If you suspect a problem, that is a job for a professional, not for a blog post.
If you want the wider habit around this, two earlier pieces fit: Is Your AI-Built App Leaking Customer Data? covers what to ask whoever built your software, and Can You Stop AI From Training on Your Website? covers the other conversation you may need to have with your website provider.
One small step
Send the question to your hosting company before you close this tab. It takes two minutes, it costs nothing, and you will either hear "already done" or find out something worth knowing. Either answer gives you your evening back.