At 1am Sydney time on Thursday 22 October, the PHP project released fixes for two critical security flaws in PHP, the programming language that runs WordPress and most shared hosting. Claimed exploit details had been circulating online since 20 October, before the fix was out. We've set out the facts on our PHP security fix page, including which versions carry the fix.
If your business website runs on WordPress, it runs on PHP, so this was your week whether or not anyone mentioned it to you. Some of the risks don't go away once a patch is out, and they're why we build sites that don't run PHP at all.
How to tell if your site runs on PHP
If you edit your site by logging in at yourbusiness.com.au/wp-admin, it's WordPress, and WordPress runs on PHP. WooCommerce, Drupal and Magento do too, as do a great many sites on shared hosting. If you aren't sure what yours runs on, your host or whoever built it can tell you in one line.
Every PHP version has a use-by date
The PHP project supports each version for four years: two years of regular fixes, then two more years of security fixes only. After that the version is end of life and gets no fixes from the PHP project at all.
PHP 8.1 reached that point on 31 December 2025. PHP 8.2 gets its last security fixes this year, on 31 December 2026. WordPress itself recommends PHP 8.3 or newer, and its requirements page says that while WordPress still works on 7.4 and later, the older versions have reached end of life and may leave a site exposed.
So a site can look perfectly fine while sitting on a version nobody is patching. For October's flaws the PHP project made official releases for 8.2 and newer only. Older versions depend on whether the host applies a fix itself, and from the outside there's no way to tell whether it has.
Most of the risk lives in plugins
WordPress core is well maintained. Patchstack, a security company that tracks WordPress vulnerabilities, counted six in WordPress core across 2025, and all six were low priority.
The add-ons are where the numbers climb. In the same report Patchstack recorded 11,334 new vulnerabilities across the WordPress ecosystem in 2025, with 91 percent of them in plugins and 9 percent in themes. Nearly half (46 percent) weren't fixed by the time they were made public. For the flaws attackers went after hardest, Patchstack measured a median of five hours between publishing its protection rule for a flaw and the first attempt to attack it.
A typical business WordPress site might run a page builder, a contact form, a backup tool, a security plugin and an SEO plugin before anyone adds a booking widget. Every one of those is someone else's code on your server, updated on someone else's schedule.
Keeping a WordPress site patched is a job in itself
Updating PHP or a plugin is rarely a single button. When a host moves your site to a newer PHP version, an older plugin or theme that was never written for it can stop working, and the usual result is a blank white screen where your homepage used to be. WordPress's own upgrade guide says to back up first and names an old plugin as a likely culprit when an update breaks a site.
The careful way is to test every update on a private copy of the site before it touches the live one. It works, and it takes time that somebody has to be paid for, which is why updates so often get put off.
For a lot of businesses around Batemans Bay the summer holidays are the busiest weeks of the year, and that's when a broken booking page or a hacked homepage costs the most. Cleaning up a compromised site properly means finding every file the attacker left behind, which is slow and careful work.
How we build sites instead
We build sites as plain HTML pages, prepared once and served ready-made from Cloudflare's network. There's no PHP on the server and no database behind it. There's no plugin list to keep current, and no login page sitting on your domain for bots to try passwords on.
Cloudflare looks after the servers the pages are delivered from, so when a PHP flaw like October's comes along, there's no PHP on your site for it to reach. Every page also carries its full text in the HTML itself, readable with JavaScript switched off, so search engines and AI search tools can read it without running any code.
Our sites are quicker. A typical WordPress page is assembled by PHP and a database when someone asks for it, unless a caching plugin has saved a copy. Ours are already built when a visitor arrives. A well-cached WordPress site can be quick too, and the difference is that ours start there. That matters where reception drops to one bar, which covers a fair bit of the drive between towns down here, and a light page that arrives ready-made gets through sooner.
It doesn't make a site untouchable. Your domain account and your email still need strong passwords and two-step sign-in, and a contact form still has to be built to keep spam out. Our optional care plan covers hosting, security updates and backups, with time each month for small changes.
The trade-offs
A static site isn't the right answer for everyone.
You won't have an editor you log in to and change pages yourself whenever you like. Changes come to us, and the care plan includes time for the small ones each month. If you post new content every week and like doing it yourself, WordPress is built for that, and a well-kept WordPress site with a good host is a reasonable choice.
Some jobs also need a server doing work in the background, such as customer accounts with logins or a very large online shop. We'll tell you when your business is one of those.
Moving from an existing site has to be done carefully so your Google rankings come with you. We've written up how a move protects your rankings and email, step by step.
What to check this week
- Find out which PHP version your site runs. Your hosting control panel normally shows it, or your host can tell you.
- Ask your host in writing whether the October fix has been applied to your account, and keep the reply.
- Look at the plugins list in your dashboard and note any that haven't been updated in a year or more.
- Look for anything you didn't put there, like odd file names in your uploads folder or pages you don't recognise.
If you'd like us to look, email chris@combinationsoupstudio.com.au with your business name and website address, or text them to 0429 109 328 if that's easier. Our Site Check is a full check of your site from the outside, no logins needed, including the PHP version where your host shows it and whether that version still gets fixes. You get a written report with recommendations by the next business day after payment, and it's paid up front. Whether your host has applied the October fix is something only your host can confirm, so ask them in writing as well.
Questions people ask
Is WordPress safe to use in 2026?
The core software is well looked after: Patchstack counted six vulnerabilities in WordPress core in 2025, all low priority. Most of the risk sits in plugins and themes, and in hosting that runs an old PHP version. A WordPress site that someone keeps updated is a reasonable choice; one that nobody looks after is where the trouble starts.
How do I find out which PHP version my website uses?
Your hosting control panel normally shows it, or your host can tell you. Ask in writing and keep the reply. Some sites show the version to anyone who looks, but many hosts hide it.
What happens when PHP 8.2 reaches end of life?
The PHP project stops releasing security fixes for 8.2 after 31 December 2026. A site on 8.2 needs moving to 8.3 or later before then, with its plugins and theme tested on a copy first.
Can I edit a static website myself?
Not through a login editor the way you would in WordPress. You send changes to us, and our care plans include time each month for small ones. If editing your own pages every week matters most to you, WordPress or a site builder may suit you better.
Will moving off WordPress hurt my Google rankings?
It shouldn't if the move is done properly. Every old page address gets a permanent redirect to its matching new page, and each page keeps the subject it ranked for. Expect some movement for a few weeks while Google recrawls.