Quick answer: On 21 October 2026, an urgent security update was released for PHP, the program WordPress websites are built on. Every website running PHP should be updated to a fixed version (PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or newer). Don’t panic. Check your PHP version in two minutes, then send your web host the short message below and ask them to confirm your site is patched.

TL;DR

• PHP, the program underneath WordPress, had two critical security weak spots fixed on 21 October 2026.
• This isn’t a WordPress problem and it doesn’t mean you’ve been hacked. It means your host needs to make sure your site is on the fixed version.
• Check your version: in WordPress go to Tools, Site Health, Info, Server.
• Copy and paste my message to your host (below) and ask them to confirm.
• If nobody who looks after your website has been in touch about this, it might be time for support that has your back.

What’s in this post

1. What actually happened, explained simply
2. Has my website been hacked?
3. How to check your PHP version (2 minutes)
4. Which versions are safe
5. The exact message to send your host
6. If your website is on an old version
7. A quick website health check while you’re there
8. Why I started my tech company, Tekmatix
9. FAQs

What actually happened, explained simply

I know the words “critical PHP vulnerability” are enough to make most business owners want to close the laptop and back away slowly. So let me explain it the way I’d explain it over a cuppa.

Think of your website like a house. WordPress is everything you see: the paint, the furniture, the front door. PHP is the foundations. You never see them, but the whole house sits on top of them.

On 21 October 2026 (overnight on 22 October here in Australia), the team that looks after PHP announced they’d found two serious cracks in those foundations, and they released a fix. The cracks have been nicknamed “PHP2Shell” (official codes CVE-2026-109618 and CVE-2026-109619), and both were rated critical, 9.2 out of 10.

In simple terms, under the right conditions they could let someone run their own code on a web server without needing a password. That’s why cyber security agencies around the world, including our own Australian Cyber Security Centre, are asking every website owner to update now.

Here’s the good bit:

• It’s not a WordPress fault. WordPress has confirmed no WordPress update is needed for this one. It’s PHP that needs updating, and that usually lives with your host.
• The fix already exists. You just need to make sure your site is using it.
• Lots of hosts are already on it. Many will have updated PHP or added protective firewall rules already. It’s still worth checking.

Has my website been hacked?

There’s no reason to assume that. This is a “please check” moment, not a “you’ve been hacked” moment.

Security companies have reported early attempts to take advantage of it, though, so it’s worth sorting today rather than putting it on the “one day” list.

If anything on your site looks off (admin users you don’t recognise, pages you didn’t create, or your site suddenly redirecting somewhere odd), let your host know straight away. In Australia, you can also call the Australian Cyber Security Centre on 1300 CYBER1 (1300 292 371).

How to check your PHP version (2 minutes)

If your website is on WordPress:

1. Log in to your WordPress dashboard
2. Click Tools, then Site Health
3. Click the Info tab at the top
4. Open the Server section and look for PHP version

Not on WordPress, or can’t find it? Most hosting dashboards show your PHP version too. And if you’d rather not go digging at all, that’s completely fine. Just send your host the message below.

Which versions are safe

The last number matters. 8.3.35 isn’t fixed, but 8.3.36 is. Because your host may have patched things behind the scenes, the simplest way to know for sure is to ask them to confirm it.

The exact message to send your host

Copy this, pop your website address in, and send it to your web host (or whoever looks after your website):

Hi, I’ve seen the urgent PHP security release from 21 October 2026 (CVE-2026-109618 and CVE-2026-109619). Can you please confirm my website [your website address] is now running a patched PHP version (8.2.35, 8.3.36, 8.4.27 or 8.5.12, or newer)? If my site is on PHP 8.1 or older, please let me know the safest way to upgrade it. Thank you!

For lots of websites, this is a quick job for the host. Done.

If your website is on an old version

If your site is on PHP 8.1 or older, it needs a slightly bigger move, up to a newer version of PHP. That’s still very doable, but older themes and plugins sometimes don’t like the jump, so:

1. Back up your whole website first (files and database). Your host can usually do this for you.
2. Update WordPress, your theme and your plugins before the PHP upgrade.
3. Ask your host to test it on a copy of your site first, if they can.
4. Click through your important pages afterwards: home page, contact forms, checkout and bookings.

National cyber security agencies have said that if an old server genuinely can’t be updated quickly, the safest option is to take it offline until it can be. If that’s you, have a chat with your host about the best way through.

A quick website health check while you’re there

Since you’re already logged in, give your site a quick tidy:

• Update WordPress itself (the latest version at the time of writing is 7.1.3)
• Update your plugins and themes, and delete the ones you don’t use
• Make sure your backups are running
• Turn on two-step login for your admin accounts

Why I started my tech company, Tekmatix

If someone looks after your website for you, they’ve probably already been in touch about this and offered to sort it. That’s what good support looks like.

If nobody has reached out to you yet, please don’t feel bad. Most business owners have never even been told what their website runs on, let alone whose job it is to keep it updated. But it might be time for support that really has your back.

That’s a big part of why I started my tech company, Tekmatix. I’ve been in business for over 20 years, and I watched so many brilliant business owners lose sleep over tech they never signed up to manage.

When your website is built and hosted in Tekmatix:

• Your hosting is included free, with unlimited websites, pages and funnels on unlimited domains
• There’s no server software for you to keep updated. No PHP versions to check, no hosting panel to log into
• Your free onboarding call gets the foundations set up with you, including connecting your domains, setting up your email sending, your branding, and connecting your AI
• There’s 24/7 live chat, with real human Teksperts when you need them, plus free live training calls every weekday
• You don’t have to learn the tech. You can run it from your phone by simply talking to your AI
• Security and privacy are built in, with GDPR compliance tools, daily backups, two-step login and infrastructure on Google Cloud and Amazon Web Services

Moving across means your website is rebuilt in the Tekmatix website builder (there are hundreds of ready-made templates, or the team can do it all for you). It’s not as scary as it sounds, and you don’t have to do it alone.

Want my team to do it all for you?

The Tekmatix Done-For-You 5 Page Website package gives you a professional new website, built and hosted in Tekmatix, for a fixed price of A$1,497, with a payment plan available (3 monthly payments of A$500). You pick a template, send in your branding and words, and the team builds it for you, with free hosting included.

See the website package

Book a free 20-minute chat with my Tekmatix team: tekmatix.com/demo

Want to get more confident with your tech and AI?

This is exactly the kind of thing I help business owners with inside the Legends Lab, my membership with live monthly masterminds and Q&A calls with me, plus 100+ workshops, courses and challenges on business, tech and AI.

FAQs

What is the PHP security update everyone is talking about? On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They could let someone run code on a web server without logging in.

Do I need to update WordPress? Not for this issue. It’s PHP that needs updating, which usually sits with your web host. It’s still a good idea to keep WordPress, plugins and themes up to date in general.

How do I check my PHP version? In WordPress, go to Tools, then Site Health, then Info, and open the Server section. Or ask your host to confirm it for you.

Does this mean my website has been hacked? No, not by itself. It means your website needs to be on the fixed version of PHP. If you notice anything unusual on your site, contact your host straight away.

Is this a one-click fix? For many websites it’s a quick job for the host. Sites on PHP 8.1 or older need a bigger upgrade, so back up first and ask your host to test it.

I’m not technical. Who can help me? Start with your web host or whoever built your website. If you’d like a team that looks after the tech for you, book a free chat with my team at Tekmatix.

Sources

• PHP.net security advisory: https://www.php.net/archive/2026.php
• WordPress.org, Critical PHP Security Release: https://wordpress.org/news/2026/10/critical-php-security-release/
• Australian Cyber Security Centre: https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php
• The PHP Foundation: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

Look after yourself (and your website).

Sarah x

This post is general information to help you check your website. It isn’t a security audit of your site. Your web host or website manager is the best person to confirm your server is patched.