Hey guys,
Please don’t skip this email.
A serious security problem was discovered this week in PHP, the technology that almost every WordPress website runs on. That very likely includes yours. Even if you’re busy, please don’t put this off.
And I owe you an apology, because I should have written to you about it sooner.
When the news about this PHP problem broke, I was in the middle of a website migration for a new client. Their website was running on a very, very old version of PHP, so we had to move it to a new hosting before we could fix anything.
When this news broke, I was in the middle of a website migration for a new client. Their website was running on a very, very old version of PHP, so we had to move it to a new hosting before we could fix anything.
Then, once it was moved, updating to the newest PHP version started causing problems. I spent days putting out fires, and writing to you completely slipped my mind. I’m really sorry...
That client story is actually the perfect example of why this matters. So let me tell you what happened, and what you need to do today.
Most WordPress websites run on something called PHP. You never see it, but it works behind the scenes, like the engine in your car. WordPress is the car you drive. PHP is the engine that makes it go. It has been around for about 30 years. Thousands of developers have used it, studied it and gone over its code again and again. Two very serious flaws had been sitting there the whole time, and people just didn't notice.
Back in August, security researchers changed that with the help of AI. They proved that these flaws could let a stranger take control of a website’s server without ever logging in. The researchers themselves called these some of the most severe flaws ever found in PHP.
So they did the right thing and quietly told the PHP team, and everyone agreed to keep it secret until a fix was ready.
But... well, people are people... and on Tuesday, October 20, someone leaked the news online before the fix was ready. Suddenly the whole internet knew there were two huge holes in PHP. The PHP team rushed and released the fix on Wednesday, October 21, a day earlier than planned. The problem even has a name now: PHP2Shell.
Within hours, security companies saw attackers trying to break into websites using these flaws. Amazon’s security team even found an attempt from October 17, before anything was public. Some governments took their own websites offline until they could update. The US cybersecurity agency and the FBI urged everyone to update immediately.
So this is not a “someday” task. It’s a “today” task.
Step 1: Check your PHP version
In your WordPress dashboard, go to Tools → Site Health → Info → Server. Look for “PHP version”.
Then compare it to the safe versions:
- 8.2.35 or higher
- 8.3.36 or higher
- 8.4.27 or higher
- 8.5.12 or higher
If your number is lower, or starts with 8.1, 8.0, 7 or 5, keep reading. Very old versions (8.1 or older) are not getting the official fix at all, so you’ll need to move to PHP 8.3 or 8.4.
Some hosts have already installed the fix without changing the version number. If you’re unsure, ask your host: “Is the PHP on my website patched for PHP2Shell?”
Step 2: Update WordPress, plugins and themes first
Old plugins and themes are the most common reason a website breaks after a PHP update. So update everything inside WordPress before you touch PHP.
Step 3: Test your website
Click through your homepage, a few blog posts, your contact form, your shop or opt-in forms, and your admin area. Make sure everything works.
Step 4: Make a full backup
Once everything works properly, make a fresh full backup. This is your safety net.
Step 5: Update your PHP
- If you know how to update PHP, do it right away. It’s usually in your hosting control panel, under something like “PHP version” or “PHP settings”.
- If you don’t know how, contact your hosting provider today and ask them to update it for you. They’ll know exactly what you mean.
- If someone manages your website for you, message them today and ask them to take care of it.
Step 6: Test everything again
Click through the same pages as before. Does everything still look and work the way it should?
Step 7: If something breaks, don’t panic
- Switch PHP back to the previous version in your hosting panel (or ask your host to do it).
- Fix the issue. Ask your hosting provider for help, or simply ask Claude or ChatGPT. Copy the error message you see and ask what’s causing it and how to fix it.
- Update PHP again once the issue is fixed, and test again.
Step 8: Make a fresh full backup
Once everything works on the new PHP, make another full backup. This is your new “safe” copy of your website.
Two more important things
- If you ever restore an older backup, check your PHP version right after. Your website files come back, but make sure your server is still on a safe PHP version.
- Don’t install any “PHP2Shell fix” plugin or copy code from a forum. The real fix happens on your hosting server, not inside WordPress.
Please don’t sit on this one.
Let’s keep your digital home safe 😊
Monika
Work smarter, not harder! Click here to read my latest blog posts!
Would you like more goodies? Check out my special Everything page ☺️
Click below to access your courses & resources.
