In the news · 21 October 2026
The PHP vulnerability: does it affect your church?
Governments and large organizations took websites offline this week. For most churches the answer to "is this about us?" is no, or "it's your host's job." For some it is "yes, today." Here is how to tell which.
What happened, in plain words
PHP is a programming language that runs on the server behind many websites. Visitors never see it. WordPress, the most common way small organizations build a site, needs it. On 21 October the PHP project released fixes for two critical flaws that could let an attacker take control of an unpatched server over the internet without logging in. Several government cyber-security agencies urged organizations to update immediately, and Cloudflare said it was already seeing attacks.
The fix is a new PHP version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older no longer get updates from the PHP project. Some hosting companies and Linux distributions apply the fix to older versions themselves, so what matters is whether your host has done so.
Websites that don't run PHP aren't affected by these flaws. That includes sites on website builders and sites built with other tools.
Which kind of church are you?
- Your site is on Wix, Squarespace, Weebly or GoDaddy's website builder. This is the vendor's job. They run and patch the servers; there is nothing to install. If you want certainty, check the company's status page or announcements, and don't answer any email that claims you must act. About 30% of the church sites we surveyed are on builders like these.
- Your site is WordPress on a hosting company (GoDaddy, Bluehost, SiteGround, and similar).
Your host runs the server and is responsible for patching PHP, but many
hosts let you pick the PHP version in the control panel, and many
sites sit on an old one. About 17% of the church sites we
surveyed ran self-hosted WordPress. What to do today:
- Log in to your hosting control panel and find a setting called "PHP version" or "PHP selector."
- If it shows 8.1 or older, switch it to the newest available, ideally 8.3 or higher, then visit your site and check it still works. Old plugins sometimes break on a new PHP.
- Log in to WordPress and apply all updates.
- Check your host's announcements, or ask their support: "Have you applied the October 2026 PHP security update to my account?" Keep the answer.
- Your site runs on a server someone set up for you (a volunteer or a hired developer manages it). Someone has to patch it, ideally today. Send them: "Please update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on the church website, and tell me when it's done." If the server runs PHP 8.1 or older, ask them how they will get a patched version.
- You don't know what your site runs on. Ask whoever built it. If nobody can say, look at the hosting bill for the company name, and call them. This is worth knowing regardless of this week's news. See your website.
What about your church management software?
Cloud services such as Planning Center and Realm are run by the vendor, so patching the servers is their responsibility, not yours. If any of your software is installed on your own server, ask the vendor whether it includes PHP and whether an update is out. Our church software page has questions to ask each vendor.
What not to do
- Don't take the site down in a panic unless your host or a technical advisor tells you to. A few days of "patch it" is the right response, not "delete it."
- Don't pay anyone who emails or phones to say your site is vulnerable or already hacked. Scammers follow headlines. Contact your host through the number on your own bill.
- Don't click "update now" links in unexpected emails. Log in to your host or WordPress directly.
- Take a backup before changing the PHP version, if your host provides one.
If you can't update today
The PHP project lists temporary settings, but says they "do not make an installation safe." Treat them as a way to buy a few hours, and ask whoever manages the server to apply the update as soon as they can.
How we know
The details above come from the PHP project's own announcement and the news coverage linked below. We have not tested any site for these flaws, and this site doesn't scan anyone's website. News reports gave a figure for how much of the internet is affected; we haven't repeated it because it hasn't been verified.