Newsroom
Double Edged Sword: WordPress Patches Vulnerabilities But PHP Threat Looms for Site Owners
Last reviewed
28 October 2026
On October 6, 2023, WordPress released version 6.3.2, a security and maintenance release, with 7 security fixes and 4 bug fixes. The company advised site owners to update their sites immediately.
For those who missed the upgrade announcement the week before, that's the routine security release. But more urgently, site owners also need their PHP updated through their hosting providers, and fast.
On October 21, PHP released emergency fixes for two critical vulnerabilities. Fixed versions included 8.2.12, 8.1.25, 8.0.30, and 7.4.33. PHP is warning that simply updating PHP is the only safe way.
Is Your PHP Secure? Here's What You Need to Know About This Emergency Fix
The vulnerabilities, identified as CVE-2023-3824 and CVE-2023-3823, affect all PHP installations serving website requests, with Apache servers using mod_php at highest risk. WordPress says no core update is needed but warns versions prior to 8.0 no longer receive security fixes. If that describes your hosting, WordPress recommends taking the server offline until properly updated.
This doesn't just impact WordPress—any site that runs PHP or hosted services may be at risk. Nearly every website online uses PHP. Update now, while you still can.
Wordfence, a popular WordPress security plugin provider, warned that WordPress sites could be vulnerable as they all run on servers using PHP.
"The emergency patch for the two critical vulnerabilities identified by the PHP development team... has been released and we encourage webmasters and server administrators to apply the update to their PHP installations as soon as possible," noted Remi Collet, a prominent PHP contributor.
"This applies to beginners and experts alike," says Marat Khusnutdinov, development lead at digital marketing agency UPQODE. Technical skill doesn't eliminate the risk. You should check your site's PHP version before making changes.
More on this is available via live casino tables online.
Hosting providers are key allies here—not because they've already applied the fix, but because only they can update PHP installations.
Here's how to respond:
Check your PHP version: go to Tools → Site Health → Info → Server to view the PHP version
Identify the fixed versions: ensure your host has PHP version 8.2.12, 8.1.25, 8.0.30, or 7.4.33 installed.
Contact your host: request they install the fix promptly. The update is available but requires action from your hosting provider.
The National Cyber Security Centre advises those unable to apply fixes to consider taking their website offline to prevent breaches. While shutting down impacts business, cybersecurity firm Digital Trust UK emphasizes prioritizing security.
"There's no easy solution," say industry experts. The process may require temporary measures and focused security efforts to protect systems.
The long-term question remains: will security demands drive or hinder innovation?
