Tekmatix Help Articles
Love your help
Use the search bar below to find help guides and articles for using Tekmatix
Use the search bar below to look for help articles you need.
WordPress PHP Security Update: Urgent Check for Every Website
Quick answer: On 21 October 2026, the PHP project released an urgent security update that fixes two critical weak spots in PHP, the program WordPress runs on. Every website running PHP should be on a fixed version: PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or newer). You don't need to panic and you don't need to be technical. Check your PHP version, then send your web host the short message below and ask them to confirm you're patched.
What happened, in plain English
Think of your website like a car. WordPress is the shiny body and the dashboard you see. PHP is the engine under the bonnet that makes it all go.
Overnight (on 21 October 2026, which was around midnight on 22 October here in Brisbane), the team that looks after PHP released a fix for two serious faults in that engine. They've been nicknamed "PHP2Shell" and their official codes are CVE-2026-109618 and CVE-2026-109619.
Both are rated critical (9.2 out of 10). Under the right conditions, they could let someone run their own code on a web server without needing a password. That's why cyber security agencies around the world, including the Australian Cyber Security Centre, have asked website owners to update straight away.
A few calming facts:
- This is not a WordPress fault. It's in PHP itself, so it affects any website that runs on PHP, not just WordPress. WordPress has confirmed no WordPress update is needed for this one.
- The fix already exists. It's simply a matter of making sure your site is running it.
- Many hosts are already on it. WordPress.org says your host may already be updating PHP and adding protective firewall rules. It's still worth checking.
Has my website been hacked?
There's no reason to assume that. This is a "please check and update" moment, not a "you've been hacked" moment. Security firms such as Cloudflare have reported early attack attempts, which is exactly why it's worth sorting today rather than next month.
If something on your website looks wrong (new admin users you don't recognise, pages you didn't create, or your site suddenly redirecting somewhere strange), tell your host straight away. In Australia you can also call the Australian Cyber Security Centre on 1300 CYBER1 (1300 292 371).
Step 1: Check which PHP version your website is running
You can do this in under two minutes.
If you have WordPress:
- Log in to your WordPress dashboard
- Go to Tools, then Site Health
- Click the Info tab
- Open the Server section and look for PHP version
If you'd rather check with your host: most hosting dashboards show your PHP version too, often in a section called something like "PHP version" or "PHP settings". If you can't find it, that's completely fine. Just ask your host (Step 3).
Step 2: Compare it with the fixed versions
| If your site is on | It should be on at least |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 or older | An upgrade to a supported version (8.2 or newer). The PHP project no longer sends updates for these. |
The number after the second dot matters. For example, 8.3.35 is not fixed, but 8.3.36 is.
Your WordPress dashboard may only show part of the number, or the host may have patched it behind the scenes. That's why the easiest, safest move is to ask your host to confirm it in writing.
Step 3: Send your host this message (copy and paste)
Hi, I've seen the urgent PHP security release from 21 October 2026 (CVE-2026-109618 and CVE-2026-109619). Can you please confirm my website [your website address] is now running a patched PHP version (8.2.35, 8.3.36, 8.4.27 or 8.5.12, or newer)? If my site is on PHP 8.1 or older, please let me know the safest way to upgrade it. Thank you!
For lots of websites, this is a quick job for the host. If someone else looks after your website for you, send it to them instead. They may well have already been in touch.
Step 4: If you're on PHP 8.1 or older
This one needs a little more care, but it's still very doable.
Moving from an old PHP version to a newer one is a bigger jump than a simple patch, and some older themes or plugins may not be ready for it. So before anyone flips the switch:
- Take a full backup of your website (files and database). Most hosts can do this for you.
- Update WordPress, your theme and your plugins first. Newer versions are far more likely to work on newer PHP.
- Ask your host to test the upgrade on a copy of your site (often called a staging site) if they offer it.
- Check your key pages afterwards: your home page, contact forms, checkout and booking pages.
The PHP security team and national cyber security agencies have said that if an old, unpatched server can't be updated quickly, the safest option is to take it offline until it can be. If that's you, your host can talk you through it.
Step 5: While you're there, a quick website health check
This PHP update is the urgent one, but it's a great reminder to give your whole site a quick once-over:
- Update WordPress itself. At the time of writing, the latest version is WordPress 7.1.3.
- Update your plugins and themes, and delete any you no longer use.
- Check your backups are running and that you know how to restore one.
- Turn on two-step login for your WordPress admin accounts if you haven't already.
Is it time for support that has your back?
If you've got someone looking after your website, they've probably already reached out to you about this and offered to sort it. That's what good support looks like.
If nobody has reached out yet, please don't feel bad. It's incredibly common. Most business owners have never been told what's running their website, let alone who's meant to keep it updated. But it might be a sign it's time for support that really has your back.
Why business owners are moving their websites to Tekmatix
Tekmatix is an all-in-one business platform with a website builder built in. When your website is built and hosted in your Tekmatix account, a lot of this worry simply goes away.
Your hosting is included, free. You can have unlimited websites, web pages and funnels on unlimited domains, all in one Tekmatix account, and we include the hosting for websites hosted on Tekmatix.
There's no server software for you to manage. No PHP versions to look up, no hosting panel to log into. The platform is looked after for you, and our systems are monitored around the clock.
Your onboarding is done with you, for free. In your free onboarding call, a Tekspert sets up the foundations with you: connecting your domains, setting up your email sending, your branding and calendar sync, and connecting your own AI.
Real help, any time. You get 24/7 live chat inside your account. Our AI assistant answers first and solves most things on the spot, and anything it can't sort goes straight to a real human Tekspert. Plus there are three free live training calls every weekday, run by real Teksperts, where you can ask anything you like.
You don't have to learn the tech. You can run your Tekmatix account from your phone by simply talking to your AI. Just tell it what you want done (a new page, an email to your list, a booking calendar) and it does the work for you.
Security and privacy are built in. Tekmatix includes GDPR compliance tools, runs on Google Cloud and Amazon Web Services infrastructure (providers that follow strict security standards including ISO 27001), uses two-step verification at login and is backed up daily.
What moving your website across actually involves
Moving to Tekmatix means your website is rebuilt in the Tekmatix website builder, rather than copying WordPress across as-is. That sounds bigger than it is:
- Pick a starting point. Choose from hundreds of ready-made website templates for every industry, or ask your AI to build the first draft in your branding.
- Bring your content across. Your words, images and key pages.
- Connect your domain. We do this with you in your free onboarding call.
- Check and go live. Test your forms, bookings and checkout, then switch over.
Want us to do it all for you?
Our Done-For-You 5 Page Website package gives you a professional new website, built and hosted in Tekmatix, for a fixed price of A$1,497, with a payment plan available (3 monthly payments of A$500). You choose a template (or show us sites you love), send us your branding and words, and our team builds your pages, opt-in form, checkout and AI chat widget, with free hosting included.
Need more than a website? Our Teksperts also offer fixed-price done-for-you set-up and migration for the rest of your business tech.
How Tekmatix can help you right now
New to Tekmatix? Book a free 20-minute demo call and we'll have a look at your tech together: Book your free demo call
Already a Tekmatix customer? Here are three ways we can help:
- Join a free daily training call. Ask a Tekspert anything, live, as often as you like: Book a free training call
- Book a done-for-you service. Have our Teksperts build your website, funnel or email set-up for you, at a fixed price: See our done-for-you services (including our Done-For-You 5 Page Website)
- Book a Tekspert by the hour to help you connect and set up your AI, so you can run your account from your phone: Book a Tekspert
FAQs
What is the October 2026 PHP security update? On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell) that could allow someone to run code on a web server without logging in.
Does this affect my WordPress website? If your WordPress website runs on PHP (almost all do), yes, it should be updated. The problem is in PHP, not WordPress, so no WordPress update is needed for this issue. Your host updates PHP.
How do I check my PHP version in WordPress? Go to Tools, then Site Health, then the Info tab, and open the Server section. You'll see your PHP version there. Your hosting dashboard usually shows it too.
Which PHP versions are safe? PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer. PHP 8.1 and older no longer get official updates, so sites on those versions should be upgraded to a supported version.
Is it really a one-click fix? For many websites it's a quick job for your host, and many hosts are applying it already. If your site is on an old PHP version, upgrading can take a bit more care, so back up first and ask your host to test it.
Do I need to do anything if my website is built and hosted in Tekmatix? Websites built in the Tekmatix website builder don't have a PHP version for you to manage, so there's nothing for you to update yourself. If you also have a WordPress site hosted somewhere else, check that one with its host.
Does Tekmatix host WordPress websites? New websites on Tekmatix are built in the Tekmatix website builder, with free hosting included. You can still connect Tekmatix forms, calendars and other tools to an external WordPress site.
Sources
- PHP.net security advisory, 21 October 2026: https://www.php.net/archive/2026.php
- The PHP Foundation: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
- WordPress.org, Critical PHP Security Release: https://wordpress.org/news/2026/10/critical-php-security-release/
- Australian Cyber Security Centre alert: https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php
- CISA alert: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
We've got your back. Team Tekmatix
This article is general information to help you check your website. It isn't a security audit of your site. Your web host or website manager is the best person to confirm your server is patched.
Latest Blog Posts
WordPress PHP Security Update: Urgent Check for Every Website
Quick answer: On 21 October 2026, the PHP project released an urgent security update that fixes two critical weak spots in PHP, the program WordPress runs on. Every website running PHP should be on a fixed version: PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or newer). You don't need to panic and you don't need to be technical. Check your PHP version, then send your web host the short message below and ask them to confirm you're patched.
What happened, in plain English
Think of your website like a car. WordPress is the shiny body and the dashboard you see. PHP is the engine under the bonnet that makes it all go.
Overnight (on 21 October 2026, which was around midnight on 22 October here in Brisbane), the team that looks after PHP released a fix for two serious faults in that engine. They've been nicknamed "PHP2Shell" and their official codes are CVE-2026-109618 and CVE-2026-109619.
Both are rated critical (9.2 out of 10). Under the right conditions, they could let someone run their own code on a web server without needing a password. That's why cyber security agencies around the world, including the Australian Cyber Security Centre, have asked website owners to update straight away.
A few calming facts:
- This is not a WordPress fault. It's in PHP itself, so it affects any website that runs on PHP, not just WordPress. WordPress has confirmed no WordPress update is needed for this one.
- The fix already exists. It's simply a matter of making sure your site is running it.
- Many hosts are already on it. WordPress.org says your host may already be updating PHP and adding protective firewall rules. It's still worth checking.
Has my website been hacked?
There's no reason to assume that. This is a "please check and update" moment, not a "you've been hacked" moment. Security firms such as Cloudflare have reported early attack attempts, which is exactly why it's worth sorting today rather than next month.
If something on your website looks wrong (new admin users you don't recognise, pages you didn't create, or your site suddenly redirecting somewhere strange), tell your host straight away. In Australia you can also call the Australian Cyber Security Centre on 1300 CYBER1 (1300 292 371).
Step 1: Check which PHP version your website is running
You can do this in under two minutes.
If you have WordPress:
- Log in to your WordPress dashboard
- Go to Tools, then Site Health
- Click the Info tab
- Open the Server section and look for PHP version
If you'd rather check with your host: most hosting dashboards show your PHP version too, often in a section called something like "PHP version" or "PHP settings". If you can't find it, that's completely fine. Just ask your host (Step 3).
Step 2: Compare it with the fixed versions
| If your site is on | It should be on at least |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 or older | An upgrade to a supported version (8.2 or newer). The PHP project no longer sends updates for these. |
The number after the second dot matters. For example, 8.3.35 is not fixed, but 8.3.36 is.
Your WordPress dashboard may only show part of the number, or the host may have patched it behind the scenes. That's why the easiest, safest move is to ask your host to confirm it in writing.
Step 3: Send your host this message (copy and paste)
Hi, I've seen the urgent PHP security release from 21 October 2026 (CVE-2026-109618 and CVE-2026-109619). Can you please confirm my website [your website address] is now running a patched PHP version (8.2.35, 8.3.36, 8.4.27 or 8.5.12, or newer)? If my site is on PHP 8.1 or older, please let me know the safest way to upgrade it. Thank you!
For lots of websites, this is a quick job for the host. If someone else looks after your website for you, send it to them instead. They may well have already been in touch.
Step 4: If you're on PHP 8.1 or older
This one needs a little more care, but it's still very doable.
Moving from an old PHP version to a newer one is a bigger jump than a simple patch, and some older themes or plugins may not be ready for it. So before anyone flips the switch:
- Take a full backup of your website (files and database). Most hosts can do this for you.
- Update WordPress, your theme and your plugins first. Newer versions are far more likely to work on newer PHP.
- Ask your host to test the upgrade on a copy of your site (often called a staging site) if they offer it.
- Check your key pages afterwards: your home page, contact forms, checkout and booking pages.
The PHP security team and national cyber security agencies have said that if an old, unpatched server can't be updated quickly, the safest option is to take it offline until it can be. If that's you, your host can talk you through it.
Step 5: While you're there, a quick website health check
This PHP update is the urgent one, but it's a great reminder to give your whole site a quick once-over:
- Update WordPress itself. At the time of writing, the latest version is WordPress 7.1.3.
- Update your plugins and themes, and delete any you no longer use.
- Check your backups are running and that you know how to restore one.
- Turn on two-step login for your WordPress admin accounts if you haven't already.
Is it time for support that has your back?
If you've got someone looking after your website, they've probably already reached out to you about this and offered to sort it. That's what good support looks like.
If nobody has reached out yet, please don't feel bad. It's incredibly common. Most business owners have never been told what's running their website, let alone who's meant to keep it updated. But it might be a sign it's time for support that really has your back.
Why business owners are moving their websites to Tekmatix
Tekmatix is an all-in-one business platform with a website builder built in. When your website is built and hosted in your Tekmatix account, a lot of this worry simply goes away.
Your hosting is included, free. You can have unlimited websites, web pages and funnels on unlimited domains, all in one Tekmatix account, and we include the hosting for websites hosted on Tekmatix.
There's no server software for you to manage. No PHP versions to look up, no hosting panel to log into. The platform is looked after for you, and our systems are monitored around the clock.
Your onboarding is done with you, for free. In your free onboarding call, a Tekspert sets up the foundations with you: connecting your domains, setting up your email sending, your branding and calendar sync, and connecting your own AI.
Real help, any time. You get 24/7 live chat inside your account. Our AI assistant answers first and solves most things on the spot, and anything it can't sort goes straight to a real human Tekspert. Plus there are three free live training calls every weekday, run by real Teksperts, where you can ask anything you like.
You don't have to learn the tech. You can run your Tekmatix account from your phone by simply talking to your AI. Just tell it what you want done (a new page, an email to your list, a booking calendar) and it does the work for you.
Security and privacy are built in. Tekmatix includes GDPR compliance tools, runs on Google Cloud and Amazon Web Services infrastructure (providers that follow strict security standards including ISO 27001), uses two-step verification at login and is backed up daily.
What moving your website across actually involves
Moving to Tekmatix means your website is rebuilt in the Tekmatix website builder, rather than copying WordPress across as-is. That sounds bigger than it is:
- Pick a starting point. Choose from hundreds of ready-made website templates for every industry, or ask your AI to build the first draft in your branding.
- Bring your content across. Your words, images and key pages.
- Connect your domain. We do this with you in your free onboarding call.
- Check and go live. Test your forms, bookings and checkout, then switch over.
Want us to do it all for you?
Our Done-For-You 5 Page Website package gives you a professional new website, built and hosted in Tekmatix, for a fixed price of A$1,497, with a payment plan available (3 monthly payments of A$500). You choose a template (or show us sites you love), send us your branding and words, and our team builds your pages, opt-in form, checkout and AI chat widget, with free hosting included.
Need more than a website? Our Teksperts also offer fixed-price done-for-you set-up and migration for the rest of your business tech.
How Tekmatix can help you right now
New to Tekmatix? Book a free 20-minute demo call and we'll have a look at your tech together: Book your free demo call
Already a Tekmatix customer? Here are three ways we can help:
- Join a free daily training call. Ask a Tekspert anything, live, as often as you like: Book a free training call
- Book a done-for-you service. Have our Teksperts build your website, funnel or email set-up for you, at a fixed price: See our done-for-you services (including our Done-For-You 5 Page Website)
- Book a Tekspert by the hour to help you connect and set up your AI, so you can run your account from your phone: Book a Tekspert
FAQs
What is the October 2026 PHP security update? On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell) that could allow someone to run code on a web server without logging in.
Does this affect my WordPress website? If your WordPress website runs on PHP (almost all do), yes, it should be updated. The problem is in PHP, not WordPress, so no WordPress update is needed for this issue. Your host updates PHP.
How do I check my PHP version in WordPress? Go to Tools, then Site Health, then the Info tab, and open the Server section. You'll see your PHP version there. Your hosting dashboard usually shows it too.
Which PHP versions are safe? PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer. PHP 8.1 and older no longer get official updates, so sites on those versions should be upgraded to a supported version.
Is it really a one-click fix? For many websites it's a quick job for your host, and many hosts are applying it already. If your site is on an old PHP version, upgrading can take a bit more care, so back up first and ask your host to test it.
Do I need to do anything if my website is built and hosted in Tekmatix? Websites built in the Tekmatix website builder don't have a PHP version for you to manage, so there's nothing for you to update yourself. If you also have a WordPress site hosted somewhere else, check that one with its host.
Does Tekmatix host WordPress websites? New websites on Tekmatix are built in the Tekmatix website builder, with free hosting included. You can still connect Tekmatix forms, calendars and other tools to an external WordPress site.
Sources
- PHP.net security advisory, 21 October 2026: https://www.php.net/archive/2026.php
- The PHP Foundation: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
- WordPress.org, Critical PHP Security Release: https://wordpress.org/news/2026/10/critical-php-security-release/
- Australian Cyber Security Centre alert: https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php
- CISA alert: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
We've got your back. Team Tekmatix
This article is general information to help you check your website. It isn't a security audit of your site. Your web host or website manager is the best person to confirm your server is patched.
