You’ve probably seen “PHP” popping up in the news lately. If you’re a foundation repair or waterproofing contractor, it’s easy to tune that out as tech talk.
But WordPress runs roughly 40% of all websites, and PHP reaches even further: it runs about 70% of websites whose programming language can be detected, including plenty of sites not built on WordPress. If your site runs on WordPress or another PHP platform, this is something you need to know about, and there’s a deadline coming up fast.
What is PHP?
PHP is the programming language that runs underneath your website. Your homepage, your service pages, your contact form, your “Request a Free Inspection” button: all of it sits on top of PHP.
Think of it this way. Your website’s design is the house. WordPress is the framing. PHP is the foundation. Homeowners never see it, and most never think about it, until something underneath starts to shift.
Why is PHP in the news?
On Oct. 21, 2026, the team behind PHP rushed out emergency fixes for two critical security flaws, nicknamed “PHP2Shell.” Either one can let an attacker take control of the server behind a website without a password or login of any kind.
Details leaked online before the fixes were ready, and attackers started using the flaws almost right away. On Oct. 26, the federal Cybersecurity and Infrastructure Security Agency (CISA) confirmed the flaws are being actively exploited and urged everyone to patch immediately. One security firm counted more than 22 million potentially exposed servers.
Think of it like finding out a master key for a popular lock brand is floating around. New locks are available, but your door is only safe once someone actually swaps yours.
Here’s the catch: the fixes only exist for PHP version 8.2 and newer. If a site is on PHP 8.1 or older, no patch is coming at all.
Why does the version number matter?
Every version of PHP has a support window. While a version is supported, the people who maintain PHP release security fixes when problems are found. When that window closes, the fixes stop. For good.
And there’s a second deadline right behind the headlines. PHP 8.2 stops receiving security updates on December 31, 2026. PHP 8.1 already lost support at the end of 2025, and older versions like 7.4 have been unsupported for years.
Here’s the waterproofing version: running an unsupported PHP version is like relying on a sump pump the manufacturer has discontinued. It still runs today. But when something fails, there’s no replacement part coming, the warranty’s expired, and you won’t know there’s a problem until there’s water on the floor.
An outdated PHP version doesn’t necessarily take your website down. The site keeps working. It just keeps working with security holes that will never be patched, and hackers specifically look for sites in that position. A hacked site can mean spam redirects, warnings in Google, lost rankings, and leads that never reach you.
This isn’t a small problem. As of late September 2026, roughly 62% of WordPress sites reporting their PHP version were running 8.2 or older. WordPress itself recommends PHP 8.3 or newer.
How do I know which PHP version my site is on?
If you have a WordPress login, it takes about a minute:
- Log in to your WordPress dashboard.
- Go to Tools > Site Health.
- Click the Info tab, then open the Server section.
- Look for PHP version.
Note the full number, including the part after the second dot. The October security fixes arrived in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If your number is lower than the one for your version, or you’re on 8.1 or older, call your host. Even a patched 8.2 only covers you until December 31.
No login, or not sure where to look? Skip it and go straight to the next step.
Who should I contact?
Call whoever hosts your website. Your host controls the server your site lives on, and PHP is part of that server. That may or may not be the company that built your site.
Not sure who your host is? Check your credit card or bank statement for a recurring hosting charge, or ask whoever built your site.
When you reach them, ask these questions:
- Have you applied the October 21 PHP security fixes to my site’s server?
- What PHP version is my site running right now?
- Can you move it to a supported version (8.3 or newer)?
- Will you test the site before and after, so nothing breaks?
That last question matters. Upgrading PHP is a bit like lifting a settled foundation: done right, everything comes back level. Rushed, and you can crack some drywall. Older plugins and themes sometimes don’t play well with newer PHP, so a good host checks compatibility first instead of just flipping a switch.
Let Team WTI handle it
If your site is hosted with Team WTI, we’re keeping an eye on PHP versions for you and will reach out if your site needs an update before the deadline.
If you’re hosted somewhere else and aren’t getting straight answers, we can help with that, too. Reach out to the Foundation Marketing Experts at Team WTI, and we’ll take a look at where your site stands. Your website is often the first impression a homeowner gets of your business. It deserves a solid foundation.
