Good news: this one isn't on you.
Your platform runs its own servers, so you don't need to patch anything.
Want someone keeping watch on it for you? That's what our monthly plans do.
Free security check · Updated Oct 21, 2026
Is your website affected?
Find out where you stand in about 2 minutes.
Two critical PHP flaws need a server fix.
On October 21, PHP released fixes for two critical flaws (nicknamed PHP2Shell) that can let attackers take over a website. If your site runs on WordPress, Drupal, Joomla or another PHP platform, the server needs an update, and updating WordPress won't apply it. The fix: the server must run PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer. PHP 8.1 and older get no official fix and need an upgrade.
How it works
Three questions, then your fix.
Pick your platform.
Tell us what your site is built on and who hosts it.
Check your version.
Type in your PHP version. We'll show you exactly where to find it.
Get your fix.
Plain-English steps for your setup, plus an email you can send your host.
The check
Find out where you stand in about 2 minutes.
You're on a patched version.
Nice work. Run the “After you patch” checks below, since attacks started before the fix shipped.
- After-patch checks
Patching stops new attacks but doesn't undo old ones. Check for admin users you don't recognize, plugins you didn't install, and unexpected redirects. If anything looks off, ask your host for a malware scan.
You're covered this time. Want a site where the next one isn't your job?
Your site needs a PHP update today.
- Email your host
Send them the email template below and ask them to confirm in writing.
Subject: Is my site patched for the October 21 PHP security fixes? Hi, On October 21, PHP released security fixes for two critical vulnerabilities (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). For my site [your website address], can you confirm: 1. Which PHP version it's running 2. Whether the patched release has been applied 3. If not, when it will be, or how I can update it myself Thanks, [Your name]
- Confirm the version
Once your host says it's done, re-run this check with the version shown in Site Health.
- After-patch checks
Patching stops new attacks but doesn't undo old ones. Check for admin users you don't recognize, plugins you didn't install, and unexpected redirects. If anything looks off, ask your host for a malware scan.
- Back up
Back up the site first.
- Email your host
Then contact support with the template. Many hosts apply this for you.
Subject: Is my site patched for the October 21 PHP security fixes? Hi, On October 21, PHP released security fixes for two critical vulnerabilities (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). For my site [your website address], can you confirm: 1. Which PHP version it's running 2. Whether the patched release has been applied 3. If not, when it will be, or how I can update it myself Thanks, [Your name]
- Confirm the version
Once your host says it's done, re-run this check with the version shown in Site Health.
- After-patch checks
Patching stops new attacks but doesn't undo old ones. Check for admin users you don't recognize, plugins you didn't install, and unexpected redirects. If anything looks off, ask your host for a malware scan.
- Send this page
Forward this page to whoever manages it. They need to update PHP, restart PHP-FPM or Apache, and confirm the new version in WordPress Site Health.
Subject: Can you check our site for the October 21 PHP security fix? Hi, PHP released fixes on October 21 for two critical vulnerabilities (fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). WordPress updates don't apply this; it's a server update. Can you confirm our site [website address] is on a patched version, and let me know when it's done? This page explains it: hellopolymer.com/php-check Thanks, [Your name]
- Confirm the version
Check it in Site Health, not just on the command line: php -v can report a different version than the one the web server uses.
- After-patch checks
Patching stops new attacks but doesn't undo old ones. Check for admin users you don't recognize, plugins you didn't install, and unexpected redirects. If anything looks off, ask your host for a malware scan.
- Back up
Back up the site first.
- Email your host
Then contact support with the template. Many hosts apply this for you.
Not sure who your host is? See the FAQ.
Subject: Is my site patched for the October 21 PHP security fixes? Hi, On October 21, PHP released security fixes for two critical vulnerabilities (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). For my site [your website address], can you confirm: 1. Which PHP version it's running 2. Whether the patched release has been applied 3. If not, when it will be, or how I can update it myself Thanks, [Your name]
- Confirm the version
Once your host says it's done, re-run this check with the version shown in Site Health.
- After-patch checks
Patching stops new attacks but doesn't undo old ones. Check for admin users you don't recognize, plugins you didn't install, and unexpected redirects. If anything looks off, ask your host for a malware scan.
Get this fixed with your host today. Then let's make sure there isn't a next time.
Your PHP version no longer gets security fixes.
Upgrade to PHP 8.3 or newer, then make sure it's the patched release.
- Back up
Back up first.
- Upgrade PHP
In cPanel, switch the version in “Select PHP Version” or “MultiPHP Manager”.
- Click through the site
Then click through the site, since older themes and plugins can break. If you're not comfortable doing this, ask your host or get our free help.
- Confirm the version
Once your host says it's done, re-run this check with the version shown in Site Health.
- After-patch checks
Patching stops new attacks but doesn't undo old ones. Check for admin users you don't recognize, plugins you didn't install, and unexpected redirects. If anything looks off, ask your host for a malware scan.
An old PHP version usually means an older site. It may be time for a rebuild, not another patch.
Let's find out. It takes one email.
- Email your host
Send your host the email template. Most will answer within a day.
Subject: Is my site patched for the October 21 PHP security fixes? Hi, On October 21, PHP released security fixes for two critical vulnerabilities (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). For my site [your website address], can you confirm: 1. Which PHP version it's running 2. Whether the patched release has been applied 3. If not, when it will be, or how I can update it myself Thanks, [Your name]
- Confirm the version
Once your host says it's done, re-run this check with the version shown in Site Health.
Not knowing what your site runs on is the real risk. Our monthly plans take that off your plate.
If you log in at yoursite.com/wp-admin, it's WordPress. Still not sure? Get free help.
Email me my results and fix steps
Never send us passwords.
We'll send your results and fix steps, plus a few emails from Polymer about keeping your site in good shape. Unsubscribe anytime.
Next time, don't be the one patching
Get a website you don't have to babysit.
We build on Webflow and Vercel, where there's no PHP server to maintain, then keep watch on your site every month.
No server to patch.
Webflow and Vercel handle the infrastructure.
Watched every month.
Uptime and form alerts, plus a monthly site check.
A team that knows your site.
Updates, fixes and new pages from people who built it.
Monthly plans are for sites we build or move onto Webflow or Vercel. We don't maintain WordPress sites.
Does updating WordPress or my plugins fix this?
No. PHP runs on the server underneath WordPress, so your host or developer has to update it.
My site is on Webflow, Squarespace or Wix. Do I need to do anything?
These platforms run their own servers, so there's nothing for you to patch. Keep an eye on their status page.
Can Polymer just patch my WordPress site?
We don't work on WordPress. Your host can apply this fix today. If you'd rather get off WordPress for good, that's exactly what we do.
Is a Webflow or Vercel site unhackable?
No website is. The difference is that there's no PHP server, plugins or themes for you to keep updated. The platform handles that, and we watch the rest.
Should I take my site down?
Usually not. If you can't confirm you're patched and your site handles sensitive data (logins, donations, forms), ask your host today.
I patched. Am I in the clear?
Patching stops new attacks but doesn't undo one that already happened. See the “After you patch” checks.
Don't know who your host is?
Look for the monthly or yearly hosting bill in your email or on your organization's card statement. Or ask whoever built the site. If it's a church, the business admin usually knows.
Can't log in to WordPress or your hosting account?
Use the host's “forgot password” link, or ask whoever has the account. Don't share passwords over email or text.
Someone else manages the site?
Send them this:
Subject: Can you check our site for the October 21 PHP security fix? Hi, PHP released fixes on October 21 for two critical vulnerabilities (fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). WordPress updates don't apply this; it's a server update. Can you confirm our site [website address] is on a patched version, and let me know when it's done? This page explains it: hellopolymer.com/php-check Thanks, [Your name]
Host says it's done but you want to double-check?
Re-run the check with the version shown in Site Health.
Patched for now?