PHP Security Flaws: Why WordPress Auto-Updates Are Not Enough

The critical PHP vulnerabilities behind this week’s precautionary website shutdowns affect a layer of software that many site owners never manage directly. Updating WordPress, a plugin or a theme is not the same as updating PHP on the server.

That distinction matters for owners who assume their usual automatic updates have already installed the fix.

PHP works behind the page you see

PHP is a server-side programming language. When someone requests a page, the server can run PHP to assemble its content before sending the finished page to the browser. WordPress relies on PHP to operate.

The newly disclosed flaws are in that underlying runtime, not WordPress’s own application code. Wordfence says WordPress automatic updates therefore will not fix them: the PHP installation itself must be updated.

What the security warning means

Security guidance describes the flaws as capable of unauthenticated remote code execution. In plain language, an attacker could run code on a vulnerable server without first signing into an account.

Both were rated 9.2 on the CVSS v4.0 severity scale, according to Wordfence’s account of the PHP security notice. That is a critical severity rating, not a percentage of websites already compromised.

Who should confirm the fix?

For managed hosting, ask the provider to confirm that the PHP runtime serving your site has received the security update. For a self-managed server, the responsible administrator needs to apply the appropriate updated packages or vendor-supported fixes.

WordPress owners can inspect their reported PHP version under Tools, Site Health, Info, then Server. However, Wordfence cautions that Linux distributions and long-term-support vendors may backport a fix without changing the apparent upstream version number. A version label alone is not always enough; check the host’s or vendor’s security notice.

For the separate account of public-service disruptions, see our report on the precautionary government and hospital website shutdowns.

Sources

• Reuters: PHP’s role and the security risks
• Wordfence: runtime update requirements and owner guidance
• Pexels: hosting photograph license