Security alert, 21 October 2026
The flaw is in PHP, not in WordPress, so plugin and core updates will not apply the fix. No developer? Send us your WP site and we will upgrade PHP and check that it still works.
No jargon, no pressure. Tell us your website and we will tell you whether it needs action.
Facts last checked: . This is moving fast; see the sources below.
Why it matters to you: a flaw like this can let someone who is not you run commands on the computer that runs your site, which can mean stolen customer data, defaced pages or malware shown to your visitors. We are not saying your site has been attacked. We are saying it is exposed until PHP is updated.
The flaw is in PHP itself, so a WordPress, plugin or theme update will not fix it, and automatic updates will not apply it.
If your site or app runs on PHP, assume yes until you have checked. The question is whether your PHP version is already at, or above, the fixed release for its branch:
| Your PHP branch | Safe version |
|---|---|
| 8.5 | 8.5.12 or newer |
| 8.4 | 8.4.27 or newer |
| 8.3 | 8.3.36 or newer |
| 8.2 | 8.2.35 or newer |
| 8.1 or older (7.x, 5.x) | No official fix. Needs an upgrade, or a vendor backport. |
Some hosts patch automatically, and some Linux vendors fix older versions under the same version number, so a version number alone does not always tell the full story. We can confirm for you.
Prices are starting points; we confirm the exact price after a quick look at your site.
$99
We upgrade PHP to a fixed release in our standard queue, usually within a few business days, and check your key pages still work. Best for simple sites where your host lets you switch PHP versions.
We need: hosting control panel access, or your host’s support contact.
from $499
Upgrade PHP to a fixed release, check your site and key pages still work, same or next business day.
We need: hosting access (control panel or SSH) or your host’s support contact.
$799
We start within hours and put you first in the queue. Paid upfront. Same scope as the Emergency patch.
We need: hosting access, and someone reachable today.
Prices in US dollars. Third-party costs (such as paid plugins or hosting upgrades) are separate. Outcomes depend on your site’s age and condition; we do not promise that a site will be free of problems. If your site needs code or plugin work to run on newer PHP, we tell you and quote it before doing it.
If it runs on PHP, it is exposed until PHP is updated to a fixed version. PHP’s own advisory says all installations serving web requests are at risk. Some hosts update automatically, so check, or send us your address.
Those versions are end-of-life and the PHP project does not ship a fix for them. Your options are to upgrade to a supported version (our usual approach) or to use a fix backported by your host or Linux vendor if they provide one. Old sites sometimes need code or plugin updates to run on newer PHP; if yours does, we tell you and agree the price before doing that work.
We never ask for credentials by plain email or on this form. After you get in touch we agree a secure method, such as a temporary account or a password-sharing link that expires, with the smallest permissions that do the job. Ideally you create a temporary account and delete it when we are done. We keep nothing longer than the job needs.
We take a backup first and have a way back to the previous state if something fails. After the upgrade we check the main pages, forms and checkout. If something cannot be made to work on the new version, we tell you plainly and discuss options rather than leaving you offline.
Yes, including Magento, Drupal and custom PHP. Tell us your platform in the form or just give us your website address.
We reply by email as quickly as we can. Do not put passwords in this form.
We are an independent service. We are not part of, and are not endorsed by, any organization listed here. Check them directly for the latest.