Critical PHP Security Update: What Website Owners Need to Know
If you’ve seen headlines about a new PHP security issue, you probably have two questions: Is my website affected? and Who is taking care of it?
Here’s the short version. If Local Leap hosts your website, we have you covered. If your website is hosted somewhere else, contact your hosting provider today and ask them to confirm the fix has been installed.
What is PHP?
PHP is software that runs behind the scenes on your hosting server. WordPress depends on it to build each page before it reaches a visitor’s browser. You may never touch PHP yourself, but if you have a WordPress website, PHP is part of what keeps it running. Kinsta has a helpful explainer on how PHP works in WordPress.
There are two newly discovered security flaws, PHP2Shell (CVE-2026-109618, CVE-2026-109619). In simple terms, they could let an attacker run their own code on a server without ever logging in. According to PHP’s official advisory, any PHP installation that serves web pages may be at risk. Read the PHP security advisory.
The PHP project released emergency fixes on October 21, 2026. Now those fixes need to be installed on every server that runs PHP.
“My website looks fine. Am I safe?”
Not necessarily. A homepage that loads normally doesn’t tell you whether the software underneath has been updated. The only way to know is to have your hosting provider check and confirm it.
Why your website might go offline briefly
If a hosting team can’t apply the fix right away, it may temporarily limit access to your site while it works. That’s a precaution, and it doesn’t mean your website was hacked.
If your business relies on online inquiries, though, you deserve to know what’s going on. Ask your website team what they’re working on, when they expect the site to be back, and how they’ll confirm everything is working afterward.
Updating WordPress isn’t enough on its own
WordPress, your theme, and your plugins all sit on top of PHP. Updating them is good practice, but it doesn’t update PHP itself. PHP is a separate piece of software on the server.
So when you ask whether your website has been updated, be specific. Ask about the PHP security patch, not just whether plugins are up to date.
These are the fixed versions PHP released for this issue:
| PHP version | Fixed release |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
Some hosting companies use their own version numbers for patched software, so your host should confirm which fix applies to you. PHP also notes that temporary workarounds only go so far. Installing the update is the real fix. See PHP’s release and update guidance.
Hosting with Local Leap? We have you covered.
If Local Leap hosts your website, there’s nothing you need to do right now. We’re already on it.
We confirmed that the PHP security updates have been installed, and extra firewall protections remain in place. We’re also reviewing each website we manage and documenting the PHP version it’s running, so you’ll have a record if you ever need one.
Want written confirmation for your records, or for a business partner who’s asking? Just reach out and we’ll send it over.
Hosting somewhere else? Contact your provider today.
If your website isn’t hosted with Local Leap, please don’t wait. Contact your hosting provider immediately and ask for a written answer to these four questions:
- Has the PHP security patch been installed? Ask for confirmation and the PHP version (or patched package) your site is now running.
- Which parts of my website were checked? This should include your live site plus any staging sites, development copies, or subdomains hosted separately.
- Is the updated version actually running? Ask them to verify the update is live and that any needed restarts were done.
- Can I get this in writing? Save the confirmation, the date it was verified, and the name of the person who handled it.
Keep that response with your website records. It’s exactly what a security team or business partner will want to see if they ask.
Not sure who hosts your website? That’s common, and we can help you find out.
How to check which PHP version your WordPress site is running
You can see your PHP version in a couple of minutes, right from your WordPress dashboard. You’ll need to log in as an administrator.
- Log in to your WordPress dashboard.
- In the left menu, go to Tools, then click Site Health.
- Click the Info tab at the top of the page.
- Scroll down and click Server to expand that section.
- Look for the line labeled PHP version. The number next to it is the version your site is using.
Compare that number to the table above. If your site shows the fixed release for its branch (or anything newer), that’s a good sign. If it shows an older number, contact your hosting provider.
You can also check your hosting dashboard. Most hosting companies show the PHP version in your account, usually in a section called PHP settings, PHP version, or something similar. If you can’t find it, your host can tell you.
A quick word of caution: the version number is a helpful first check, but it isn’t the final word. Some hosting companies apply the security fix without changing the version number, and some sites run more than one copy of PHP behind the scenes. That’s why it’s still worth getting written confirmation from your host that the patch is installed and running.
And if you’ve ever been told to upload a file to “see your PHP info,” skip that. Those files can expose details about your server to anyone who finds them. Site Health and your hosting dashboard are safer ways to check.
Running an older version of PHP? Time to plan an upgrade.
PHP 8.1 and earlier no longer receive regular updates from the PHP project. Some hosts offer special patches for older versions, but that’s a short-term fix, not ongoing protection. The safer path is moving to a supported version, with testing to make sure your site still works as expected.
Also worth noting: security support for PHP 8.2 ends on December 31, 2026. If your site runs 8.2, now is a good time to plan your next upgrade. Check PHP’s supported versions.
Make security part of your regular routine
Security alerts are much less stressful when you already know who manages your hosting, which versions of your site exist, and how updates get confirmed.
Your website is often the first place customers meet your business. Keeping the technology behind it up to date protects that investment.
Questions about your website’s PHP version or hosting security? Contact Local Leap Marketing and we’ll help you figure out your next step.