WORLDWIDE PHP SECURITY EVENT // Important // Updating your WordPress plugins isn't enough

WORLDWIDE PHP SECURITY EVENT // Important // Updating your WordPress plugins isn't enough

If you have seen the news today regarding recent security updates and vulnerabilities, it relates directly to PHP.

If you use platforms like Squarespace or Shopify, you don't need to do anything. They don't run user-managed PHP environments and their internal security teams automatically manage platform infrastructure/security.

If you are running a self-hosted WordPress site (which they think 40% of the internet does) there are a few steps you need to take immediately.

Updating the plugins for this one isn't enough, as this particular vulnerability (rated 9.2/10) is with the server infrastructure underneath your site, and the plugins, themes or WordPress core can't patch it.

Here are the urgent steps to take:

1. Check your PHP version //

Within your WordPress dashboard, navigate to Tools > Site Health > Info > Server.

2. Upgrade if you are on PHP 8.1 or older //

Older versions are end-of-life and will not receive security patches.

3. Contact your hosting provider //

Confirm whether they have applied the latest PHP security updates across your server infrastructure.

4. Update plugins and core files //

Whilst logged in, update your plugins and themes to ensure secondary vulnerabilities are kept closed.

--

Full control over your web infrastructure can be a great thing, but it also means committing to ongoing server maintenance. If you do not have an internal team or a dedicated partner managing this, events like this are a good prompt to review how your site is supported, as this likely will be the first of many.