The PHP bug is patched, now check your site's version
The fix landed, but your site only gets it once your host installs it.
The critical PHP bugs are patched. PHP is the software that most websites, including WordPress sites, run on. We covered the warning earlier when the fix was still hours away.
Developer @levelsio, who had pulled all of his sites and servers offline until the patch landed at 2 PM UTC, posted afterwards that everything was back up, thanking Ubuntu and the PHP Foundation for shipping the fix fast.
What the bug was
Julian Goldie SEO calls it PHP2Shell. It is two critical bugs inside PHP itself, rated 9.2 out of 10 for severity. He says attackers were already trying to use it. @levelsio put the scale of it plainly, noting that 69.3% of the web runs on PHP.
The one thing to do
A patch only protects you once it is actually installed on your server. Log into your hosting account and find your PHP version. It is usually under a settings or tools area in your host's dashboard.
The safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you see one of those, you are done. If you are on 8.1 or older, ask your host to update you now. Julian Goldie SEO says the whole check takes five minutes.
If you cannot find the PHP version yourself, send your host one message asking which PHP version your site is on and whether the PHP2Shell patch has been applied. Managed WordPress hosts often handle this for you, but it is worth getting the answer in writing rather than assuming.
That is the end of it. There is no follow-up action, no plugin to install, and nothing in Search Console to check. Once your version is on the safe list, go back to work.
Everything is back up
2 critical bugs inside PHP itself, rated 9.2/10. Attackers are already trying it.
Be the person who already knew
One email a day. Under three minutes. You will hear about a Google change before it shows up in your traffic.