On 21 October 2026, the makers of PHP released a security fix. PHP is the software that runs many websites, including most WordPress sites. You do not see it when you visit a page. It works in the background.
The fix closes two serious holes. Someone on the internet could use them to take over a website without logging in.
If your site uses PHP, it should be updated. The versions that include the fix are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Pass those version numbers to the person who hosts the site.
If A + L hosts or maintains your site, contact us. We will check the version and install the update.
If someone else looks after the site, ask them to install this PHP update. You can point them to the official notice on PHP.net.
The only reliable step is to install the update.
PHP 8.1 and anything older no longer receive fixes from the PHP project. Some hosts still patch those versions on their own. If yours does not, the site should move to a current version. PHP 8.2 stops receiving security fixes on 31 December 2026.