Your website is the part of the business you never think about. Someone set it up a few years ago. It takes gift-card orders, reservations and “is that sofa still in stock” questions while you sleep. This week it’s worth a phone call.
On October 21 the PHP project released emergency updates for two critical flaws that can let an attacker who never logs in run their own code on a web server. W3Techs counts PHP on 69.3% of websites whose server-side language it can identify, and it’s what WordPress runs on.
Why governments unplugged their own sites
CISA, the federal cybersecurity agency, told organizations to patch immediately. It said anyone who can’t update right away, or who runs PHP 8.1 or older, should take those systems offline until they can. The U.K.’s National Cyber Security Centre also urged an immediate update — and said systems that can’t be patched or protected quickly should be considered for taking offline. Finland’s government websites and the Dutch House of Representatives went offline on Wednesday.
CISA said it hadn’t seen the flaws used in an attack when it published. The same day, threat researchers at watchTowr and Sophos said they were already seeing criminals discuss and attempt it. “Whilst nobody has been successful to date,” watchTowr’s Jake Knott said, “we don’t expect that will last long.”
Updating WordPress doesn’t fix this
The flaws are in PHP itself, not in your theme or your plugins. Clicking “update” in the WordPress dashboard doesn’t touch it. Whoever runs the server has to move PHP to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The PHP project says there are no complete mitigations and updating is the only safe choice.
Older sites have a harder road. PHP 8.1 and earlier no longer get regular releases from the PHP project, and W3Techs shows more than a third of PHP sites still on version 7 or older. For these two flaws, the project posted bare-bones fixes for 7.4, 8.0 and 8.1 that someone has to build by hand, and some Linux vendors and support providers patch old versions on their own. If yours doesn’t, the site has to move to a supported version.
Your web person can’t fix this from the WordPress dashboard. It has to happen on the server.
Where your card numbers go matters
Wiz, one of the two firms that found the flaws, says an attacker can also read server memory that may hold passwords and API keys. Those are the credentials that connect a site to the services behind it, your payment gateway included.
If your checkout sends customers to your processor’s hosted payment page, card numbers never sit on your server. A break-in is still serious: an attacker who controls your pages can change them, even point your checkout button at a fake payment form. If card numbers are typed into a form your own server handles, a compromised server can see them. That’s the site to fix first, and it’s also the setup that makes PCI compliance heavier for a small store.
If your site lives on a hosted builder where you never see a server, the fix is the platform’s job. It still costs you one line in an email to have them confirm it.
If it can’t be patched today
CISA says a web application firewall may give some protection until the update is in. The PHP project lists temporary settings that reduce exposure but, in its words, “do not make an installation safe.” If neither is an option, do what the governments did. Take the site down, put up a page with your phone number, and take orders by phone for a day or two.
The email to send your web host today
- 01Is our PHP patched for the October 21 flaws? Ask for the exact version. 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer has the fix. If the number is lower, ask whether their Linux vendor’s package includes it. While you’re at it, ask them to turn off PHP’s “session upload progress” setting, as the PHP project suggested on October 23.
- 02If we’re on 8.1 or older, what’s the plan? Ask whether they backport fixes or whether you need to move to a newer version, and by when.
- 03Do card numbers ever touch our server? Ask whether checkout uses your processor’s hosted payment page.
- 04Has anyone checked for signs of a break-in? The NCSC tells anyone who couldn’t update right away to look for backdoors an attacker may have left behind.
Send it before the weekend. A confirmed patch means you’re done with this one. If the answer is “let me check,” don’t let it slide past Monday. And note that PHP 8.2 stops getting security fixes on December 31, 2026, so a site on 8.2 needs to move to 8.3 or newer before then.
Joe Radest
1 Step Technologies — Peachtree City, GA. 25+ years in the payment industry, over $50M in volume a month.