On 21 October, PHP released an emergency fix for two critical flaws that let a stranger take over a website with no password needed. PHP is the software that runs WordPress. If your business has a WordPress site, this PHP vulnerability is yours to check.

The flaws were found by Wiz, a US cloud security company, which named them PHP2Shell. Wiz says every PHP version released in the last decade is affected, going back to version 5.4. Google's cloud security team puts the vulnerable range at PHP 5.4 through 8.5.11.

The fix exists. The question is who installs it.

What happened this week

PHP's security team posted notice on 20 October that an urgent fix was coming the next day. Details of both flaws leaked online before that fix was ready, according to security firm Huntress. That handed attackers a head start.

The fixed versions arrived on 21 October: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Each of the four numbers is the patched release for one line of PHP. Those four numbers matter, because they are how you check your own site later in this piece.

Here is how the flaws work, in plain terms. Every time someone opens a page on your site, PHP sets aside a small space on the server to handle that visit. When the visit ends, PHP is meant to wipe that space clean for the next person.

Both flaws are mistakes in that wiping. In the first, a visit can be cut off halfway, and PHP then tidies up as if everything had finished properly. In the second, information from one visit gets left behind and the next visit picks it up.

An attacker triggers these mistakes on purpose. They send a visit designed to leave the space half-wiped, with their own commands sitting in the gap. The server then runs those commands as if they belonged there.

What a hacker does once inside

Here is why that matters to your business. Attacks on small business sites are usually quiet. The site looks normal when you check it. The damage lands on your visitors, your Google ranking and your email. Here are the five common outcomes. Click any box to open it.

Each outcome costs money. Lost search traffic, lost trust and paid hours of clean-up all come out of the same budget.

Who patches depends on where your site lives

This is the part the headlines walk past. Whether you have to do anything depends on the platform that runs your site.

Mashed Avocado runs sites on all three platforms, so we checked our own. The Shopify store and the Squarespace sites needed no action. Our WordPress sites sit on Bluehost. On the morning of 22 October, Melbourne time, the server reported PHP 8.4.27, the fixed release, already in place. Bluehost had installed it on its own. Other hosts moved early as well: SiteGround told its customers it was protecting them ahead of the release and that they needed to change nothing.

A site you forgot about is still a site.

A "coming soon" page or an unlisted site still runs WordPress and PHP behind the scenes. Attackers use automated tools that scan every address on the internet. A site with no visitors gets found just as quickly as a busy one.

Timing matters too. WordPress patched a separate critical flaw in September. Security company Patchstack recorded the first attack attempts about five hours after that fix came out, TechRadar reported. Attackers treat every published fix as a map to the hole it closes.

What to do this week

Check one number. Log in to WordPress and go to Tools, then Site Health, then the Info tab, and open Server. Look for "PHP version". A reading of 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a number above it on the same line, means your host has patched. A number below it means you contact your host and ask when the fix lands. PHP released fixes for those four lines only. A site on 8.1, or a version starting with 7, needs moving up to one of them.

Update WordPress, plugins and themes. In the dashboard, open Updates and click update on everything listed. Plugins are the add-ons that give WordPress extra features, and each one is another door into your site. Remove any you have stopped using.

Delete the sites you have stopped using. Back the site up first, then ask your host to remove the files and the database. A deleted site offers attackers nothing to break into. Cancel any hosting plan that only served that site, and keep the domain name if you might reuse it.

Check your PHP version today. If it matches one of the four patched versions, your site is protected from these two flaws.