A serious flaw in PHP, the code behind WordPress and a large share of the web, left organisations rushing to update their websites. Here’s what happened and what it means for yours.
If you’ve seen council, NHS or government websites go offline recently, or caught the headlines about a global security flaw, you might be wondering what it all means for your own website. In short, a serious weakness was found in PHP, the programming language behind WordPress and a huge number of other websites. The details then leaked online before the fix was ready to go out as planned, which left everyone who looks after websites with very little time to act.
As soon as the fix was released, we applied it across our clients’ websites, and since then we’ve been asked a lot of the same questions. People have wanted to know what this means for them, and why a flaw that was spotted months ago suddenly turned into an emergency. So we thought it might help to put the answers together in one place, in plain English. That way you can see what happened and what we’ve done about it, and why keeping your website up to date matters more now than it used to.
What actually happened?
The researcher who helped uncover the flaw, Ryan Austin, explained it with a simple comparison. Imagine a small grammatical mistake in a sentence. Normally that would just make the sentence sound a bit odd. This mistake was different – instead of sounding silly, it was the equivalent of leaving a way for a burglar to get into your house.
The “sentence” in this case is PHP, the programming language behind a huge number of websites. The flaw meant someone could potentially get in without needing a password. Austin has studied PHP security for around 20 years and described it as the most serious issue he has ever found.
What is PHP?
PHP is the code that runs behind the scenes on many websites. When you visit a page, it gathers the information needed and puts it together so you can read it. It powers WordPress, Wikipedia and many online shops, so most people use it every day without knowing.
What do I need to do?
Check with your developer or agency that they took the required action. If you notice anything unusual on your site, get in touch with your developer or agency straight away. Alternatively, give us a call because we can help and if you are having issues a few weeks after the incident, this is a serious concern.
How was the flaw found?
Researchers first spotted a possible weakness back in 2024 but couldn’t see how anyone could realistically use it. This year, security firms used advanced AI tools to work out that it could be exploited after all, and worked with the people behind PHP on a fix.
What could an attacker have done?
In the worst case, someone could run their own code on the server. That could mean accessing personal data stored on the site, such as form submissions or customer details, or leaving a hidden way back in for later.
What’s involved in protecting a website?
If the PHP flaw was like finding a weak lock on your house, protecting a website is the ongoing work of keeping the locks in good order.
Keeping the software up to date
Every website runs on layers of software: PHP at the bottom, then WordPress, then the theme and plugins that add features like contact forms. Each one gets regular updates, often to fix security problems, and we keep them all up to date.
What a PHP upgrade involves
Because PHP sits underneath everything else, changing it affects the whole site. Before upgrading, we check whether the platform (WordPress, Magento or Laravel) and any custom code will work with the new version. Anything that won’t is updated first, and plugins that are no longer supported may need replacing. Custom code written for an older version sometimes needs rewriting.
We then update PHP and test the site properly, checking pages load, forms send, and things like logins, bookings or payments still work. Anything that breaks is fixed before we sign it off. On a straightforward site this can be quick, but older sites or those with lots of plugins or custom features take more time.
What is a patch and what does a PHP patch involve?
If your site was already on a recent, supported version of PHP, such as 8.2, it didn’t need a full upgrade. Instead, it needed a patch.
A patch is a small fix released for the version you’re already on. It closes the security hole without changing how PHP works, so WordPress, your theme and plugins carry on as before. Going back to the house, it’s like replacing a faulty lock with a fixed one of the same design, rather than changing all the doors. Because of this, a patch is much quicker than an upgrade. We apply it to the server and then check the site is working normally, including forms, logins and anything else important.
PHP 8.2 will stop receiving security patches at the end of this year. Security support for PHP 8.2 ends on 31 December 2026, after which the PHP project no longer publishes security fixes for it.
Why did big websites go offline?
The UK’s National Cyber Security Centre advised that where a fix couldn’t be applied straight away, organisations should consider taking their site offline until it could be. That’s why you may have seen government, council and NHS sites temporarily unavailable. It was a precaution, not a sign they had been hacked.
If it was found months ago, why the sudden panic?
The plan was to release the fix quietly in late October, giving everyone time to update. Details leaked early on social media, and a video showing how the attack could work was posted by mistake. That forced the fix out ahead of schedule and gave everyone very little time to act.
How is AI finding these flaws?
The flaws in PHP had been sitting in the code for more than a decade. Researchers had even spotted a possible weakness before, but couldn’t work out how anyone could realistically use it. What changed this year is that security researchers used advanced AI tools that can read through huge amounts of code and spot problems far faster than people can.
Much of the software the internet runs on was written years ago, when the priority was making things work rather than making them secure. AI is now going back through that old code and finding things humans missed. As one researcher put it, the bugs weren’t new – what changed was the ability to find them.
That works both ways. The same tools that help security teams find and fix problems can also help attackers find weaknesses and build ways to exploit them. In this case, once details leaked, attackers were reportedly using AI to try to work out the attack for themselves. This is why we expect more issues like this to come to light, and why keeping websites up to date matters more than it used to.
Should I change my passwords?
You don’t need to change your website password because of this, as your site should have been updated. As a general rule, if any service you use asks you to change your password following this issue, it’s worth doing – but go to the website directly rather than clicking a link in an email.
Should I watch out for scam emails?
Always, but particularly now, yes. Big news stories like this are often used by scammers to send fake emails, for example claiming your website has been hacked or asking you to log in to “fix” a problem. We will never ask you for your password by email. If you get a message about this that you’re not sure of, forward it to us before clicking anything.
Is it over now the fix is out?
The fix closes this particular flaw, but security experts expect more attempts to exploit it over the coming weeks, now that the technical details are public. Websites that haven’t been updated will be the main targets. Yours has been, but this is a good reminder of why regular updates matter.
This also isn’t the end of vulnerabilities.
In the last six months, WordPress has put out seven security releases fixing 47 vulnerabilities. In the six months before that, there were two releases fixing 10. Two of the recent releases were rated critical, and one was serious enough that WordPress forced the update onto sites itself. The releases are also arriving closer together. Twice this year, a second security release followed the previous one within a week. Part of the rise comes from new code in the 7.0 and 7.1 releases, and part from AI tools that let researchers find bugs faster than before. Neither of those is going to slow down, so a monthly update cycle can now leave a site open for weeks to a problem that already has a fix.
UK security bodies are expecting the same trend. Steve Sands, Chair of the BCS Information Security Specialist Group, has warned that AI tools are likely to find many more unknown software vulnerabilities in the coming months, and that organisations need to get better at responding to them. Ollie Whitehouse, CTO at the National Cyber Security Centre, has also urged organisations to prepare now for what he calls a “patch wave” – a rush of updates needed across every part of the technology stack as new vulnerabilities are disclosed. For PHP sites, that means updating has to become routine rather than something done when there’s time.
