PHP's emergency security fix: ask whoever runs your old website for a date
The PHP Foundation and National Security Agency have issued a warning. People are taking down their websites as precaution until a fix is available.
If your website was built years ago by someone you no longer talk to, nobody may be watching the software that got an emergency fix this morning.
PHP, the language every WordPress site and a great many custom sites run on, released fixes today for two flaws that can let a stranger take over the server, and with it the files and customer data behind your contact and order forms. The NSA told organizations to update immediately, and to take the site offline if they cannot.
The most exposed sites are the ones nobody thinks about. Built by an agency that moved on. Hosting renewed on the same card for six years. Forms and uploads still live. Sites on PHP 8.1 or older are past official support, so a fix depends on the host having backported one.
What to do today.
Email whoever hosts or maintains the site one sentence: has the October 21 PHP security fix been applied, and if not, on what date will it be?
Ask for a date. "We keep everything up to date" is a reassurance, and you need a date.
No answer by tomorrow morning, call the host directly and ask the same question.
Check that a recent backup exists and that someone has restored one.
If the reply reads like a foreign language, send it to me and I will tell you what it says.