Shocking PHP Vulnerabilities: Was Your Host Up to the Challenge?
Take it easy.
We'll cache you outside.
Pressable is proud to support the WP Minute. We had a whole pitch ready about how Pressable MCP makes everything you do easier, but take care of you first. Go drink some water. Have another cup of coffee. Take a deep breath. Go for a walk. (We're ready to chat managed WordPress hosting when you're ready.)
Eric's Notebook:
Shocking PHP Vulnerabilities: Was Your Host Up to the Challenge?
You’ll never be bored if your work involves web security. The daily barrage of calamities will keep you warm in the winter and absolutely sweating in the summer. Last week’s PHP vulnerabilities turned up the heat more than most.
Imagine a rogue actor executing code from your server without needing an account. That’s how bad this was/is. The worst part was that site owners, agencies, and freelancers were completely dependent on their web host to fix the issue.
Updating your WordPress installation or plugins didn’t matter in this case. The only surefire way to resolve the issue was to install the latest release of PHP 8.2, 8.3, 8.4, or 8.5. For most of us, this means waiting for the host to act.
WP Minute member Jeff Chandler said it best on LinkedIn: “Today is one of those days where people will get to see if the Managed WordPress host they use actually manages it.”
I host client websites with a few different providers. I’m happy to say they all appeared to handle the issue efficiently. However, some communicated their plans better than others.
Classified Listings (Buy yours)
WP Client TrainingWP Client Training is a course designed specifically for WordPress experts who need to prepare clients to maintain a WordPress website.
Omnisend Ask ChatGPT or Claude things like "What drove revenue this week?" or "What's my campaigns missing?" - it'll answer using your real, live data. No exports, no tab-switching. Just ask.
Pressable MCP Managed Hosting just entered the chat. Ask your AI to create sites, pull & analyze logs, automate reports or run WP-CLI commands. With just a prompt. Weeks of work, done over a cup of coffee.
TrazoForms a free, easy-to-use drag-and-drop WordPress form builder. Eleven color palettes, conditional logic, works without JavaScript.
Communication may be as important as action in these situations. People get nervous when they see a serious vulnerability in the news, especially one of this magnitude. The uncertainty can lead to chaos.
Keeping clients in the dark won’t help. The hosts who proactively emailed and posted on social media likely calmed more minds than they frazzled. Regardless, I feel for the network engineers and support technicians who dealt with panicked bosses and customers.
In the last newsletter, we discussed how AI is fueling the rise in vulnerability reports. The numbers will keep rising, as will the urgency to fix them. Web hosts must prioritize clear communication to keep clients informed.
So, how did your host handle the great PHP scare of 2026? If you work for a host, what was your experience like? What lessons did you learn? Hit reply or visit our Slack community.
What we published this week
Your WordPress Security Plugin Isn't Enough
Take a closer look at the state of WordPress security with Robert Abela, founder and CEO of Melapress. He joins us to discuss the findings from Melapress’s annual WordPress security survey.
Can You Sell Your WordPress Agency for $200K?
What makes a WordPress business worth buying? In this episode, Kurt and Toby break down a listing for a WordPress business asking $200,000, with 24 clients and $60,000 in annual recurring revenue.
Improve Your WordPress Skills for Free
Here at The WP Minute, we’re all about helping you level up. That’s why we keep expanding our course library. Each course is designed to teach you valuable skills in bite-sized pieces. In other words, we built them for busy WordPress professionals like you!
We encourage you to check out our latest free courses:
- How to get started contributing to WordPress: Topher DeRosia guides you on the journey from being a user to becoming an active member of the global WordPress community.
- JetHost for Agency Owners: Ben Meredith provides an honest look at how to make hosting a true partner in your agency through a combination of AI and UI tooling and fast (human) support. JetHost is a Pillar Sponsor of The WP Minute.
- Omnisend for Agency Owners: Follow along with Ben Meredith as he shows you how to deliver high-value email marketing services, automate cart recovery, and use AI-powered workflows to audit and manage Omnisend accounts for your clients. Omnisend is a Pillar Sponsor of The WP Minute.
Stay tuned for more course announcements in the near future!
The best part of this community is you! Share your experience, challenges, and wins in our new member interview series.button
Our Amazing Pillar Sponsors
Our Foundation+ Sponsors
Enroll For Free!
Our new courses and WP Minute Slack community are completely FREE. Join us and level up your WordPress business!
