Free website check
Is your website affected by the October PHP security flaw?
On 21 October 2026, the people who maintain PHP released emergency fixes for two critical security flaws. PHP is the software every WordPress website runs on. These flaws can let an attacker take control of the server your website sits on, without needing a password. Details leaked before the fix was ready, and attempts to use the flaws were reported within a day.
If your business website runs on WordPress, or anything else built on PHP, it needs the fix.
The good news
Many reputable hosting companies patched their servers quickly, and some protected their customers before the fix was even released. If your site is with one of them and has been kept up to date, you may not need to do anything.
Where the risk is
- Cheap or unmanaged hosting, where nobody is applying updates.
- Sites still on an old version of PHP. Anything before PHP 8.2 no longer gets security fixes, so the site has to move to a current version, and older themes and plugins don't always survive the move.
- Sites built a few years ago that nobody has touched since.
You usually can't tell which of these applies just by looking at your website. That's what the check is for.
Sources: the PHP project's security advisory and list of supported versions, and Sansec's timeline of the leak and the first reported attempts.
The free check
Send me your website address. I'll look at your site from the outside, the same way any visitor's browser sees it, and work out who hosts it and what it runs where that's visible. I won't need a login, and I won't test or probe your site.
Within one business day you'll get a short reply in plain English that says one of three things:
- 1.
You're fine, and why.
- 2.
You're probably fine, but ask your host this one question to be sure. I'll give you the wording.
- 3.
Your site needs work, and here's what that involves.
There's no cost and no obligation.
If your site needs work
I'll quote a fixed price before I start. For most small WordPress sites it's A$295 to move PHP to a supported, patched version, update WordPress, plugins and theme, remove anything that isn't being used, and confirm there's a working backup. Older sites can need more, and I'll tell you that up front.
If I find signs that someone has already been in, I'll stop and talk to you before going any further.
If you'd rather not think about this next time, I also look after websites on a monthly care plan, from A$199 a month.
What this isn't
This is a practical check and tidy-up. It isn't a full security audit or a penetration test, and nobody can honestly promise that a website can't be hacked. If I find something that needs a security specialist, I'll tell you.
Who's checking
I'm John Costabile, and I run Lumomatics from Red Hill. I spent 25 years in IT support, systems administration and infrastructure, including monitoring critical diagnostic imaging systems for hospitals in Australia and New Zealand.