Patch PHP now or take your website offline
In brief
According to the NSA, two critical security holes have been found in PHP, which powers a large share of websites including WordPress, and the PHP Foundation has already issued patches. OpenAI and Google's Wiz say AI-assisted research found the flaws before any known attacks in the wild. The NSA advises taking a site offline if it cannot be patched immediately.
What it changes for an SME
If your company runs a website on PHP, including WordPress, you face a short window to patch or to take the site down. According to the NSA, an unpatched site should come offline until the PHP Foundation fixes are applied, which can mean downtime and lost sales. OpenAI says researchers found the holes before any known attacks, but Wiz warns that AI can now help adapt an exploit across PHP versions. The holes can expose the server file system or a database, and WordPress says you must patch the server with your host; PHP 8.1 and older are unsupported, with 8.5.12 recommended.
What you can do
- Ask your host or IT provider which PHP version you run and whether the PHP Foundation patches are applied, targeting version 8.5.12.
- If you cannot patch immediately, follow the NSA advice and take the public website offline until you can.
- Confirm with your host that WordPress or other PHP applications on the server are covered.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.