Last updated: Thursday 22 October 2026
Update as at 2:45pm ACDT, Thursday 22 October 2026: WP Engine has now completed patching across its platform. We are reviewing all client sites to confirm they are running the patched PHP version and checking for any signs of unusual activity. We will continue to update this page as the review progresses.
You may have seen news this week about a serious security issue affecting a huge number of websites around the world, including WordPress sites. Here’s a plain-English explanation of what’s happening, what’s being done about it, and what it means for your website.
What’s happened?
Your website is built on WordPress, and WordPress runs on software called PHP. Think of PHP as the engine under the bonnet. On Wednesday 21 October, two serious flaws in PHP were made public. They’ve been nicknamed “PHP2Shell” and are both rated critical (9.2 out of 10). In the wrong hands, they could let someone take control of a website’s server without needing a password.
Details leaked online earlier than planned, and the PHP team released fixes the same day.
Why this one is different?
Most security issues we deal with are inside WordPress or its plugins, and we fix them by updating your site. This one sits a level below, on the server itself. That means WordPress updates and security plugins (like Wordfence) can’t fix it. The fix has to be applied by the hosting provider.
Where WP Engine comes in
The websites we host are with WP Engine. Because this is a server-level issue, we rely on WP Engine’s to make the patch available, and they’re working on it. They’ve put extra protection in place at the network level while they roll out the updated PHP across their whole platform. You can follow their progress on the WP Engine status page.
What we’re doing
- We’ve been across this since the news first broke on Wednesday, and we’re following WP Engine’s updates closely.
- Retainer clients come first. Clients on our monthly support and maintenance plans are our highest priority. We’re checking that their sites are on a current, patched version of PHP and looking for any signs of unusual activity
- We’ll keep this page updated as things develop.
Do you need to do anything?
For most clients, no. There’s no update button for this one; it’s handled on the server and then we ensure the site is running the patched PHP version. A few simple things still help:
- Make sure two-factor authentication is switched on for your login. Here’s our guide.
- Use a strong password that you don’t use anywhere else.
- If you notice anything unusual, let us know straight away. That includes your site sending visitors somewhere strange, user accounts you don’t recognise, or pages you didn’t create.
A note on older websites
Some older websites run on versions of PHP that no longer get regular security updates. Moving them to a newer version usually needs some testing and plugin updates first, so it’s best done with our help. If you’re not sure where your site sits, get in touch.
Not on a support and maintenance plan?
Threats like this are becoming more frequent, and they move fast. Attack attempts began within hours of these details appearing online. This is also the second major WordPress-related security issue this year, after “wp2shell” in July.
With monthly support and maintenance, we keep an eye on your site, keep it updated, and you’re at the front of the queue when something like this happens. There’s never been a better time to have someone looking after your website.