PHP Vulnerability: Is Your WordPress or Squarespace Website Affected?

Updated October 23, 2026

If you've seen headlines this week about websites going dark, you may be wondering whether yours is at risk. A critical PHP vulnerability sent web hosts, governments, and companies around the world scrambling to install fixes. Here's what happened, what to do if your site runs on WordPress, and where Squarespace sites stand.

What is the PHP vulnerability?

It's a pair of critical security flaws in PHP, the behind-the-scenes open-source programming language that runs a huge share of websites, including every WordPress site. The flaws could let an attacker take control of a website's server from the internet, without a password. PHP's developers released emergency fixes on Wednesday, October 21, 2026.

According to the Associated Press, governments and other organizations in Europe and the U.S. took their websites offline temporarily while they installed updates, and the FBI warned that the flaws could let attackers run their own code on affected sites. One security expert quoted by the AP said PHP powers roughly 70% of websites where the underlying language can be identified.

That doesn't mean 70% of websites have been hacked, or even that they're all vulnerable. Whether a site is at risk depends on whether the server it runs on has been updated. But security researchers reported attacks starting almost immediately, so this isn't a "get to it eventually" situation.

Is my WordPress website affected?

If your site runs on WordPress, assume it's at risk until your hosting company confirms the server has been updated. Updating WordPress, your theme, or your plugins won't fix this one. The flaw is in PHP itself, the layer underneath WordPress, so the fix has to happen on the server.

Many hosts patched quickly, so there's a good chance you're already covered, but I would definitely check to be sure.

What should I ask my web host?

Ask them to confirm that the server running your site is on a fixed version of PHP: 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

• If a developer or agency manages your site, ask them the same question today.

• If your site runs on an older version of PHP (8.1 or earlier), there's no official fix. Ask your host what they recommend, because this is the situation security agencies are most worried about.

• If they can't confirm it's updated, ask whether your site should go offline until it is. That's what security agencies advised for sites that couldn't update right away.

Does Squarespace use PHP?

You can't add or run PHP on a Squarespace website, and Squarespace runs and maintains its own servers, so there's nothing for you to install or update. One small note: if you use Acuity Scheduling for bookings, Squarespace listed emergency maintenance for Acuity on October 21 related to this flaw, so keep an eye on any emails from Acuity and make sure your bookings are working.

Why I build on Squarespace

I designed websites in WordPress for about 10 years, and I understand why so many people choose it. It's open source, so the software is free. Hosting can be inexpensive. And it's incredibly flexible. I liked all of that.

But free software comes with a job attached: keeping it safe. A WordPress site needs regular updates to WordPress itself, to the theme, and to every plugin. Sometimes updating one plugin breaks another, or breaks the layout, and someone has to sort it out. And as this week showed, there's also the server software underneath it all, which a site owner may not even know exists until it makes the news.

Flaws like this are also likely to turn up more often. As CNN reported, the weakness behind this flaw had been sitting in PHP's code for years, and AI tools helped researchers find it in a matter of days. Those same kinds of tools are widely available, which also makes it easier for attackers to move quickly once a flaw is public. That makes the time between a fix being released and a fix being installed matter more than ever.

Security flaws like this one are always a possibility with any software. The question is who's responsible for catching them. With Squarespace, you pay a little more each month, and in return the platform handles the servers, the security updates, and the behind-the-scenes maintenance. No platform can promise it will never have a problem, but on Squarespace, fixing server-level issues is their job.

For the businesses and nonprofits I work with, that trade is worth it.

Frequently asked questions about the PHP vulnerability

Has the PHP vulnerability been fixed? Yes. PHP released fixes on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. A website is only protected once the server it runs on has been updated.

Will updating my WordPress plugins fix it? No. The flaw is in PHP, not in WordPress or its plugins. Your hosting company, or whoever runs your server, has to update PHP.

Do I need to do anything if my website is on Squarespace? There's nothing for you to update on the server side. If you use Acuity Scheduling, watch for emails from Acuity and check that your bookings are working.

How do I know if my website runs on PHP? If it's built on WordPress, Drupal, or Joomla, it does. If you're not sure what your site is built on, ask whoever built it or your hosting company.

Thinking about a change?

I build Squarespace websites for businesses, nonprofits, and churches in New Hampshire and across the US. If you're on WordPress and tired of keeping up with updates, I'd be glad to talk it through.