If your business website runs on WordPress (loads of them do), this one's worth two minutes of your Monday. Last Tuesday (21 Oct) the PHP team pushed out emergency security fixes. PHP is the behind-the-scenes language that runs most websites, WordPress included. Two serious holes were found, partly by security researchers at OpenAI and others. Left unpatched, they could let someone run code on your web server without ever logging in. The AI angle is the bit I keep thinking about. AI is getting really good at finding bugs. That helps the good guys, but attackers have the same tools. So "I'll update when I get round to it" is getting riskier. What to actually do: - In WordPress, go to Tools > Site Health > Info > Server and check your PHP version. Patched versions are 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer). - Not sure, or not on WordPress? Message your web host or web person: "Have you patched PHP for the 21 October security release?" Most decent hosts are already on it. - On PHP 8.1 or older? That doesn't get fixes any more, o ask about upgrading. You don't need to update WordPress itself for this. It's the server underneath. Honest caveat: when the US cyber agency CISA put out its alert, no successful attacks had been seen yet, and many hosts patch this automatically. But it's a five-minute check against a potentially very bad week. Learn what your site runs on, implement the check, ask your host if you're unsure, and share what you find here. Source (WordPress.org): https://wordpress.org/news/2026/10/critical-php-security-release/ Who hosts your website, and did they tell you about this, or did you have to go looking?