A serious flaw hit nearly every WordPress site last month. Here’s why our clients didn’t have to worry about it.
In late October, a serious security problem turned up in the software that runs most of the websites on the internet. If you have a WordPress site, yours was almost certainly one of them.
The good news is that it’s fixed, and if we take care of your site, it’s already been handled. But it’s a good reminder of something I talk about a lot: websites need regular care, even when nothing seems wrong. Here’s what happened, in plain English.
What happened
Every WordPress website runs on a behind-the-scenes engine called PHP. You never see it, but it’s what turns your site from a pile of files into pages people can visit.
On October 21, the people who maintain PHP announced they’d found two serious flaws in it. Together, these flaws worked like a master key: someone could break into a website without a password, without logging in, and without anyone noticing right away.
Think of it like finding out the lock on your front door, the one nearly everyone in town uses, can be opened with a bent paperclip. The lock company made a fixed version the same day. But the fix only protects you once someone actually swaps out your lock.
That last part is the important bit. Within hours, criminals were already testing doors to see whose locks hadn’t been changed yet. The federal government’s cybersecurity agency put out an alert the same day, telling everyone to update immediately.
Who was affected
Pretty much everyone with a WordPress site, plus millions of other websites built on the same engine. It didn’t matter how big or small your business is, or what kind of hosting you have.
The sites at the most risk were the ones running an old version of PHP. Like an old phone that no longer gets updates, older versions of PHP don’t get security fixes anymore. Those sites couldn’t just be patched. They had to be moved up to a newer version first, which takes more care, because older parts of a website don’t always play nicely with newer software.
What I did
For every website on an Apricity maintenance plan, here’s what happened that week:
- We checked every site. We looked at who hosts it and exactly which version of PHP it runs.
- We confirmed the fix was in place. Many hosting companies apply updates like this automatically, but “usually” isn’t good enough, so we checked anyway.
- We applied the fix ourselves where needed. Some sites live on servers where nobody updates anything unless a person does it. We did it.
- We moved older sites up to a supported version. For the sites running outdated PHP, we did the bigger upgrade and made sure everything still worked afterward.
- We let our clients know. A calm heads-up explaining what was going on, then a second note warning them about scam emails (more on that below).
None of our clients had to lift a finger. Most of them heard about the problem from us, already fixed.
What you should do now
If you’re not sure your site was taken care of, here’s a short checklist:
- Ask whoever manages your website. One simple question: “Was our site updated for the PHP security problem in October?” A good answer is a clear yes, with the version number. A shrug is not a good answer.
- If you manage it yourself, call your hosting company. Ask them which version of PHP your site runs and whether it has the October security fix. If they tell you you’re on an older version that no longer gets updates, it’s time to upgrade.
- Don’t count on a “maintenance mode” plugin to protect you. Putting your site in maintenance mode hides it from visitors, but it doesn’t close the door this flaw opened.
- Watch out for scam emails. Scammers love security news. Expect emails that look like they’re from your hosting company, warning you to “update now” or “verify your account.” Don’t click the links. If you’re not sure, forward it to your web person and let them take a look
If you aren’t one of my maintenance clients, but you have questions about your site, I’m happy to check your site’s PHP version and let you know where you stand. No strings attached.
The bigger lesson
Most of the time, an outdated website just sits there quietly. It looks fine. It loads fine. Nothing seems wrong, until the day something is.
No single plugin or setting would have saved anyone from this. What made the difference was having someone who actually checks: who knows what your site runs on, notices when the ground shifts, and takes care of it before it becomes your problem.
That’s what website maintenance really is. It’s not glamorous, and when it’s done well, you barely notice it. That’s the point.
If you’d like to talk about keeping your site cared for, get in touch. I’d love to help.
Sources
This article was written by Apricity Web Solutions with editorial and fact-checking support from AI tools. All content has been written, reviewed and refined by a human.
