If you run a small business website, the past week of WordPress security news may have felt like a lot. Urgent emails from your host. Alarming posts in Facebook groups. Headlines calling one problem “worse than Log4j”. It was hard to tell what actually needed doing.
The good news is that for most small business owners, the answer was very little. But a couple of things genuinely mattered, so here’s a calm rundown of what happened, what applies to you, and what doesn’t.
PHP2Shell: the big one, mostly handled for you
PHP is the programming language WordPress runs on. On 20 October, details leaked early about two serious flaws in PHP itself, nicknamed PHP2Shell. In the worst case, they could let an attacker run their own code on a web server without logging in.
It was serious enough that several government sites, including some here in Australia, went offline for a time while the problem was dealt with, and the Australian Signals Directorate urged anyone running PHP to apply the fixes as soon as they were available.
PHP released fixes on 21 October, in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older versions (8.1 and below) are no longer supported and won’t get an official fix.
Here’s the part that matters for you: if your site is on shared or managed hosting, your host installs the fix, not you. You can’t update PHP yourself on most hosting plans. The hosts I work with both put extra protection in place straight away and began rolling out the patched versions within a day.
What you can do:
- Check your PHP version. In WordPress, go to Tools → Site Health → Info → Server. If it’s below 8.2, ask your host to move you up.
- Check it’s been patched. Your host may move you to one of the fixed versions above, or add the fix to the version you’re already on, in which case the number stays the same. Their status page should say which (see below). If it doesn’t, a quick message to your host will clear it up.
- Plan ahead. PHP 8.2 only gets security fixes until 31 December 2026, so if you’re on 8.2, now’s a good time to ask about moving to 8.3 or 8.4.
UpdraftPlus: a breach at the company,
not in the plugin
UpdraftPlus is one of the most popular backup plugins for WordPress. Over the weekend of 17–18 October, the company behind it, TeamUpdraft, found that someone had accessed its customer database. That included customer details and the connection keys for UpdraftCentral, their tool for managing several sites from one dashboard.
TeamUpdraft says the plugin itself and its downloads weren’t affected, and neither were backups stored in your own Google Drive, Dropbox or similar.
What to do depends on how you use it:
- Free plugin, no account with TeamUpdraft: keep the plugin updated. That’s it.
- You have a TeamUpdraft account: change your password there (type the address in yourself rather than clicking an email link), and anywhere else you’ve used the same password.
- You use UpdraftCentral, or you pay for UpdraftPlus Premium: follow TeamUpdraft’s notice carefully. It covers updating the plugin, removing the old connection key, and checking your site for admin users or plugins you don’t recognise.
What not to do: delete UpdraftPlus because someone in a group said to. If your backups stop running, you’ve swapped a problem that probably didn’t affect you for one that definitely does.
How to read a security alert without panicking
Both of these stories spread faster than the facts. A few habits help:
- Go to the source. Read the notice from the company involved (your host, the plugin developer, PHP itself) before acting on a social media post.
- Check whether it applies to you. Many alerts only affect a particular setup, version or feature.
- Patch, don’t remove. Updating is almost always the fix. Removing tools, especially backups, can leave you worse off.
- Watch for follow-up scams. After a breach makes the news, fake “security warning” emails often follow. If an email asks you to log in or download something, go to the site directly instead.
Check your host’s status page first
Before you email your host or raise a ticket, look for their status page (usually status.yourhost.com, or linked from the footer of their website). I like to bookmark mine for easy reference at these moments. During a big security event, hosts post updates there as they go: what they’re patching, how far through they are, and anything you need to do yourself. Often your question is already answered, and if it isn’t, you’ll at least know what to ask. Having worked in support, I can tell you that a ticket that starts with “I’ve seen your status update, but…” gets to the point much faster than one that starts from scratch.
This week, both hosts I use posted that the fix had been added to the existing PHP versions, so the version number on the sites didn’t change. Without the status page, that would have looked like nothing had happened.
Three questions to ask your host
If you’re not sure where you stand, these three questions cover most of it:
- Have you applied the latest PHP security release to my site?
- Which PHP version is my site on, and is it still supported?
- Are my backups running, and where are they stored?
A good host will answer all three quickly.
You don’t have to keep track of all this yourself
Weeks like this are exactly why I offer WordPress Maintenance & Care Plans. Checking versions, applying updates, reading the vendor notices and letting you know what (if anything) you need to do is part of the job, so you can get on with running your business.
