The PHP Security Flaw: What Therapy and Private Healthcare Practices Should Check Now

If your practice website runs on WordPress, it runs on PHP, and your host needs to confirm it has installed this week's PHP fix. Sites on Squarespace and Wix run on those companies' own servers, so there's nothing for you to install. If you use Showit with its WordPress blog, ask Showit about the blog.

We've read the advisories from PHP, WordPress, and the US and UK cyber agencies. This is what they mean for a practice website, written on October 22, 2026. You don't need to be technical to follow it.

What Happened This Week?

On Wednesday, October 21, the team that maintains PHP released fixes for two critical flaws. PHP is the programming language underneath WordPress, and it runs about 70% of websites, according to the researchers who found the flaws. The flaws let a stranger run their own code on a web server without logging in, the PHP project's advisory says.

Governments moved fast. The websites of Edinburgh, Bristol, and Oxford councils went offline while they were patched. So did the Paris police prefecture's site, The Guardian reported. The National Security Agency told organizations that can't update right away to take their systems offline. CISA, the US cyber defense agency, gave the same advice to anyone still running PHP 8.1 or older.

The flaws had sat in PHP's code for more than a decade, and AI tools found them. Calif, a security firm, found one using an OpenAI model, OpenAI says. Wiz, an Alphabet-owned security company, found both on its own, using its AI research tool alongside models from Google and OpenAI.

Has anyone used them yet? On Wednesday, CISA said it had not seen them used in attacks. Amazon said its security team caught an attempt against one of its decoy systems on October 17, four days before the fix was public. The NSA expects attackers to put the flaws to work.

Why Does This Matter for a Practice Website?

It's easy to assume nobody would bother attacking a solo therapist's website. These attacks are rarely aimed at anyone in particular. Programs scan the internet for servers that have not been updated and try the same trick on every one. "There's going to be a lot of automatic exploitation of this," Michał Woźniak, an internet infrastructure expert, told The Guardian.

Alan Woodward, a cybersecurity professor at the University of Surrey, warned of a "long tail" of websites that are not well maintained. Woodward told the paper to expect "weeks and months of ongoing attacks." A practice site built a few years ago, and left alone since, sits in that long tail.

The first worry is what people have sent you. Popular form plugins such as Gravity Forms keep a copy of every message in the site's database. Gravity Forms says those entries aren't encrypted by default. On a practice site, that can include the message someone wrote late at night about why they want to start therapy. The researchers also showed the flaws can expose passwords and keys held in the server's memory.

Then there's what a referred client finds. When someone is given your name, they look you up. A hacked site can send them to spam pages, and Google can show "This site may be hacked" beside your listing. A site taken offline shows them nothing at all.

And cleaning up takes time. Even after the site is clean, the warning stays until Google reviews it. That review can take from a few days to a few weeks, Google says.

Is Your Practice Website Affected?

Start by working out what your site runs on. If you are not sure, open your website on a computer, right-click the page, choose View Page Source, and search for "wp-content". If it appears, your site runs on WordPress. You can also ask whoever built it, or check who you pay for hosting each month.

We found no statement from Squarespace or Wix about these flaws when we checked on October 22. Their customers can't install server software, so there's nothing for them to do.

If Your Site Runs on WordPress, Do This Today

One thing first: updating WordPress or your plugins won't fix this. The flaw sits in PHP, underneath WordPress. WordPress says no WordPress update is required or planned.

1. Find your PHP version. In your WordPress dashboard, go to Tools, then Site Health, then Info, and open Server. Your host's control panel usually shows it too.
2. Compare it with the fixed releases. The fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. If your version is 8.3.30, for example, it still needs the update to 8.3.36.
3. If it is 8.1 or older, treat it as urgent. The PHP project no longer releases updates for those versions. Ask your host or developer to move the site to a supported version. Then test your contact form and booking links yourself.
4. Ask your host to confirm in writing. Many hosts added temporary protections this week. Those help, but PHP's own team says only the update is a complete fix. Send three questions: Which PHP version is my site running? Has it been updated to the fixed release? If not, when will it be?
5. Change your passwords once the update is in. Because the flaws could expose passwords held in memory, change your WordPress login, and ask anyone else with access to change theirs. If your forms or newsletter connect to other services, ask your developer to replace those connection keys too.
6. Look for signs someone got in. The UK's National Cyber Security Centre told organizations to check for "backdoors installed by an attacker." In WordPress, look for users, plugins, or pages you don't recognize. In Google Search Console, open the Security issues report. WordPress's guide for hacked sites lists more checks.

Finding nothing is reassuring, but it doesn't prove the site is clean. The researchers say some attacks leave little trace in a site's logs. If you find something you can't explain, ask your host or a security professional for help. If your forms collect anything about a person's health, speak with your privacy adviser as well.

What If You Can't Reach Anyone Today?

If your site runs PHP 8.1 or older and no one can update it soon, take it offline until it's fixed. CISA, the NSA, and the National Cyber Security Centre all point that way. That feels drastic for a practice that depends on its website.

Ask your host to switch the site off and show a simple page with your name, phone number, and email while the work is done. Your Google Business Profile and directory profiles can take inquiries in the meantime.

The Gap Between a Fix and an Attack Is Shrinking

AI found this week's flaws, and AI also makes the next few days riskier. Once a fix is public, AI tools can reverse engineer the bug "with little effort," The Guardian reported, citing experts. OpenAI, which coordinated the response with PHP's maintainers, expects "similar findings to increase sharply in the coming months."

So, who updates your website? And how would you know if they hadn't? If the honest answer is "nobody" or "I'm not sure," settle it this month, before the next notice arrives.

Some practices settle it by choosing a platform that runs the servers for them, such as Squarespace. Others stay on WordPress for the control it gives and pay someone to keep it current. Our WordPress vs Squarespace guide compares the upkeep on each.

How We Can Help

We look after websites for therapy and private healthcare practices. Website Care is the technical plan in our Practice Visibility & Care range. It covers technical care, monitoring, and platform updates for $295 a month, month to month.

For a wider read of your site, request a free credibility audit. You get a written audit naming the fixes we would make first, with the evidence behind each one, within 3 business days.