If you have a WordPress website, you may have seen scary headlines this week about a security flaw. Here's the short version: security experts found a serious problem in the software that every WordPress site runs on. Hackers can use it to take over a website, and some have already started trying.

The good news is that there's a fix and it came out on October 21, 2026. The question is who's responsible for putting it on your site. If you run your own server, that's probably you. Even on a regular hosting plan, it's worth checking that it was done.

Below, we explain what happened in plain English, how to tell whether your site is at risk, and what to do next.

What happened

Think of WordPress as a car and PHP as its engine. PHP is the behind-the-scenes software that makes your website work. You never see it, but your site can't run without it.

Security experts recently found two serious flaws in that engine. They let a hacker break into a website without needing a password. Once inside, they could change your pages, steal customer information or use your site to spread spam or viruses.

The people who make PHP released a fixed version on October 21 (official announcement). Security companies report that hackers have already started trying to break in (Patchstack).

One important point: keeping WordPress and your plugins updated doesn't fix this. The problem is in the engine underneath, so the engine itself has to be updated, and that happens on your web server.

Is your site at risk?

Your site is more likely to be at risk if any of these sound like you:

• You (or someone you hired once) set up your own server. No one updates the engine automatically. It stays unfixed until someone logs in and does it.
• You use an inexpensive hosting plan. Many low-cost hosts do update the engine, but updates can arrive later than the official fix.
• Your site is several years old and hasn't had much upkeep. Older sites often run an old version of PHP. The PHP team no longer releases official updates for those, so a fix only happens if your host builds one for you.
• You don't know who looks after your website. If nobody's job is to watch for problems like this, nobody's watching.

What to do this week

You don't need to be technical to do most of these.

1. Find out your PHP version. Log in to your WordPress dashboard and go to Tools, then Site Health, then the Info tab. Open the Server section, and you'll see it listed as "PHP version." Write it down.
2. Make a backup of your website. Your hosting account or a backup plugin can usually do this. A backup lets you undo things if something goes wrong.
3. Contact your hosting company. Ask them: "Have you installed the October 2026 PHP security fix on my site?" Get the answer in writing.
4. If your PHP version is 8.1 or lower, ask a developer about upgrading. Those versions are too old to get regular fixes. Upgrading can break older plugins, so have it tested on a copy of your site first.
5. If no one can fix it right away, ask about adding a firewall service like Cloudflare. It works like a security guard at the door, blocking known attacks before they reach your site. It's a stopgap, not a cure (Tenable).
6. Watch for warning signs. These include strange new user accounts, pages you didn't create, your site sending visitors somewhere else, or your host or Google warning you about your site.

What this looked like for our clients

We host our clients' websites with WP Engine, a company that specializes in looking after WordPress sites. On the day of the scare, our clients didn't have to lift a finger. Here's what happened behind the scenes, according to WP Engine's status page (times are Eastern):

This included older websites. A few of our clients' sites run an older version of PHP that the PHP team no longer updates. WP Engine fixed those too, so those sites were covered the same day.

We watched the whole thing, checked our clients' sites afterward for any breaks and kept them updated by email. With managed hosting, a team of experts is already working on the problem by the time it reaches the news.

Was hosting it yourself a mistake?

Not necessarily. Lots of businesses start out that way to save money, and it's a fine choice when someone is keeping an eye on things. This week simply showed what that "someone" has to do: notice the news, understand it and fix the server the same day.

If that sounds like more than you want on your plate, here's how the two options compare:

If you do decide to switch, it's a good moment to tidy up your site too. We move everything over, test it and handle the switch, so your visitors barely notice.

Not sure where your site stands?

We'll check your website for free. We'll tell you which version of PHP it runs, whether it's at risk and what it would take to fix, in plain English. There's no pressure to switch.

Request your free site check →

Common questions

Is my website affected?

If your site runs on WordPress and your host hasn't installed the October 2026 fix, assume it could be. The quickest way to find out is to ask your hosting company directly.

I keep WordPress and my plugins updated. Am I safe?

Unfortunately, that doesn't cover this one. The problem is in PHP, the engine underneath WordPress, and that gets updated on your server, not in your WordPress dashboard.

What is PHP, again?

It's the software that powers WordPress behind the scenes. You never interact with it directly, but every page on your site depends on it.

Can't I just install a security plugin?

A security plugin is a good idea in general, but it can't fix this problem. The fix has to be installed on the server itself.

My site is old, and my developer says upgrading PHP will break it. What now?

This is more common than you'd think. In the short term, you need a host willing to patch older versions, as WP Engine did. In the long term, the site needs an upgrade. Usually it's a few outdated plugins causing the trouble, and those can be updated or replaced. In some cases we recommend a redesign and build but only if necessary.

If you're interested in a redesign Request your free quote →

How would I know if my site was hacked?

Watch for user accounts you don't recognize, pages or links you didn't add, visitors being sent to other websites, or warnings from Google or your host. If you're unsure, our free site check looks for these.

Does managed hosting mean I never have to worry about security?

No website is completely risk-free, just like no house is. But picture two homes: one with just a locked door, and one with an alarm and a security company watching it 24/7. Either could be targeted, but which would you rather own?

Managed hosting is the second house. Someone is always watching, so problems get caught early. This week, extra protection was guarding our clients' sites before the fix was even installed.

How much does switching cost, and how long does it take?

It depends on your site. Our free site check includes a clear quote and timeline, with no obligation. Request your free site check →