The October 21 PHP security alert is a reminder that your firm’s website can look perfectly fine while running software that urgently needs attention. The pages load, the contact form works, and nothing looks different to a visitor.
PHP, the technology behind WordPress and many other websites, released emergency updates addressing two critical security vulnerabilities that could allow attackers to run commands on affected servers without logging in. CISA urged organizations to patch immediately.
For accounting firms, the first step is to confirm that your website provider has addressed the issue. If your site’s age or underlying technology prevents the necessary updates, you’ll also need a plan for replacing what’s holding it back.
Understanding the Issue
The two vulnerabilities affect PHP itself, which runs on a website’s server. That means a website can require attention even if its content is current and its WordPress dashboard shows no pending updates.
PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Its advisory also explains that some vendors provide security fixes for older versions. Your hosting provider should confirm which fix applies to your environment and whether it has been installed.
WordPress issued its own notice directing website owners to check their PHP version and work with their hosting provider. Updating WordPress alone does not confirm that the server’s PHP installation has been patched.
You don’t need to become a developer to respond. But you do need a clear answer from the people responsible for your website.
What Your Firm Should Do Now
Contact your website provider or hosting company and ask:
- Does our website use an affected PHP installation?
- Have the October 21 security fixes been applied to the server running our site?
- Is anything preventing the update?
- If the site cannot be patched promptly, what action are you taking to protect it?
Ask for confirmation that the work is complete. Until the update is applied, the site may remain vulnerable.
If your provider identifies a compatibility problem, have them explain what is causing it and what it will take to resolve it. That conversation should establish whether the problem involves one replaceable component or a broader limitation of the site.
The UK’s National Cyber Security Centre advises organizations to consider taking affected systems offline when updates cannot be applied and temporary protections cannot be implemented promptly. PHP cautions that its temporary measures reduce exposure but do not make an installation safe.
If your website cannot be secured, it may need to come offline until it can be fixed. Your provider should make that assessment promptly. Waiting for a redesign to be planned and completed is not an adequate response to an immediate vulnerability.
When an Update Becomes a Redesign Conversation
A security alert does not automatically mean your firm needs a new website. If your provider can apply the fix and keep the existing site properly maintained, that may be all this incident requires.
The more difficult situation is a site that depends on outdated components no one supports anymore. An old theme, abandoned plugin, or custom feature may prevent it from working with supported software. If every necessary update threatens to break something, your firm needs a plan to replace the components preventing those updates.
A visual refresh won’t resolve those dependencies. New photography, revised copy, and a cleaner homepage can improve the visitor experience while leaving the same maintenance problems underneath.
When the underlying build prevents reliable updates, a redesign can replace obsolete technology and make the site easier to maintain. It gives the firm an opportunity to rebuild on supported software, remove unnecessary components, and establish a manageable process for keeping the site current.
Build Ongoing Maintenance into the Project
A redesign should come with clear answers about what happens after launch:
- Who maintains the hosting environment and website software?
- Who monitors security notices and handles urgent updates?
- How will changes be tested and backups maintained?
- When will aging components be reviewed for replacement?
A new website will still need updates. The goal is to make those updates routine and assign responsibility before an urgent notice arrives.
For a firm whose existing site can no longer be maintained, planning a redesign now provides time to make thoughtful decisions about content, functionality, and the client experience. An emergency shutdown leaves far less room for that work.
If you’re unsure whether your firm’s website can keep up with necessary updates, contact The Growth Partnership to assess your site and determine whether targeted fixes or a redesign would best address the problem.
