🔒 PHP Security Vulnerabilities

You may have seen news, or received an email from your host, about two serious security vulnerabilities in PHP, the code that runs WordPress. Here’s where things stand.

Because this is a server-level issue, the fix must be applied by your web host, not from inside WordPress.

We’ve been in communication with hosts since this was first announced, and they’re actively rolling out the available patches right now. Most hosts we’ve spoken with started mitigating this even before the official fix (since some details were leaked yesterday).

Cloudflare also released a protective firewall rule, and we’ve confirmed that the new rules are active on the sites we manage, which adds an extra layer of protection in the meantime.

There’s nothing for you to do at this time. But we wanted to keep you updated and reassure you that we’re all working together to make sure your site stays safe.

Please go easy on your host today and don’t contact them for support unless absolutely necessary. Their time is best spent updating PHP right now.