If you run a WordPress blog, check that your host has patched PHP. The PHP project released emergency fixes on October 21 for two critical vulnerabilities, known as PHP2Shell, that can let an attacker execute code without logging in. WordPress runs on PHP, but the usual WordPress, theme and plugin updates do not update PHP itself.

The fixes shipped in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. You need a patched build; moving to a higher branch alone does not establish that. Vendors can also apply the fixes to older builds, so ask the host to confirm patching if your displayed version is lower. PHP’s developers warn that temporary mitigations reduce exposure to particular attacks but do not provide a complete fix.

WordPress shows your PHP version under Tools > Site Health > Info > Server. On shared or managed hosting, ask the provider to confirm that the PHP serving your website has received both fixes. You may be able to select a PHP branch in the control panel, but the host controls which builds are available. Back up the site and check theme and plugin compatibility before changing branches. If you administer your own VPS or dedicated server, updating PHP is your responsibility.

Namecheap, for example, temporarily enabled a partial read-only mode named HackGuardian across EasyWP, its managed WordPress service. This blocked new theme and plugin installations. Its October 22 update reported that security updates had been rolled out to all EasyWP websites and the restrictions had been lifted.

Hosting providers may introduce temporary protections while waiting for patched PHP packages, then roll out updates across their servers in stages. Website functions may be temporarily restricted during that process, as EasyWP’s example shows. Follow your provider’s status updates and check whether patching has finished for your service. An announcement that mitigation is in place can come before the PHP update itself.

Keep WordPress core, themes and plugins updated, remove unused plugins, and use strong passwords and two-factor authentication. Back up both your files and database, and make sure you know how to restore them. Watch for unexpected changes and unfamiliar administrator accounts. A PHP patch closes these vulnerabilities; investigating signs of an existing compromise is a separate job. For this alert, confirm that the PHP running your blog has received both fixes.