On 21 October 2026 the WordPress project published a short, urgent notice: the PHP project had released a security update for two critical vulnerabilities, and every site owner should update PHP immediately. WordPress itself does not need an update, because the problem is in the language underneath it.
If you sell online, that notice is a useful moment to look at how your store is built.
What WordPress.org asked you to do
- Update PHP as soon as possible.
- Ask your host whether it has already patched PHP or added firewall rules, and confirm it yourself.
- Find your PHP version under Tools, Site Health, Info, Server, or in your hosting control panel.
- If you run a PHP version older than 8.2, which no longer gets security fixes from the PHP project, and you manage your own hosting, consider taking the server offline while you upgrade.
For fixed version numbers and technical details, see our earlier guide on the PHP flaw for store and app owners.
The real cost of an emergency
Patching PHP is usually quick when your host does it. The pain comes from what surrounds it:
- Plugins or themes that stop working on the newer PHP version.
- A checkout that breaks quietly after the update, losing orders for days.
- No one in charge of testing, backups or monitoring.
- A mobile app whose server nobody remembers to patch.
If this week felt stressful, that is a sign that your store depends on too many moving parts that nobody owns.
When to stay on WordPress
Stay if your catalogue is small, your plugins are few and well supported, your host patches quickly and you have someone responsible for updates. Update PHP today and keep going.
When to move to a custom platform
Consider it if:
- You run an old PHP version or an old theme you are afraid to update.
- You rely on many plugins for pricing, B2B rules, stock or shipping.
- Pages are slow on mobile and checkout feels fragile.
- You want an Android and iOS app on the same orders and stock.
- You sell in several countries and need local payments and currencies.
A purpose-built platform has fewer third-party parts, one shared back end for website and app, and a named team that patches, backs up and monitors it for you. A platform that does not run PHP is also not exposed to this PHP flaw, though it still needs the same care as any system.
How NNT Mart helps
- Review of your current store: PHP version, plugins, speed and risks.
- Migration of products, customers and order history, with redirects so your search rankings are kept.
- A faster mobile-first store with the payment methods your buyers use.
- Android and iOS app on the same back end.
- Support after launch, with patching, backups and monitoring agreed in writing.
Not sure what you run? Send us your website address and we will tell you what is under the hood and what to fix first. Use the contact form or WhatsApp on this page and we reply within minutes.
What the notice really said, line by line
The WordPress.org notice was short, and short notices get misread. Here is what it actually told site owners, and what each part means for someone who just wants to sell.
“Update PHP immediately.” PHP is the language your server uses to build your pages. Updating it means switching your hosting to a newer, patched version. It is usually a setting in your hosting panel or a request to your host.
“Check for updates from your web host.” Many hosts patch PHP centrally and may add firewall rules that block attacks. WordPress.org still asked owners to confirm rather than assume.
“Find your PHP version under Tools, Site Health, Info, Server.” A one-minute check inside the WordPress admin. If you cannot see it, your hosting panel usually shows the same number.
“No WordPress update is required or planned.” The problem lives in PHP, which means it affects any server running PHP, not WordPress specifically.
“PHP before 8.2 no longer receives security updates from the PHP project.” If you run something older, you are not getting these fixes from the source.
“If you manage your own hosting and run an older version, consider taking the server offline while you prepare to upgrade.” WordPress.org pointed to the UK National Cyber Security Centre’s advice that organisations should consider taking a system offline until it can be fully mitigated where immediate remediation is not feasible.
Notice what is not in that list: panic. The advice is practical and boring. Update, confirm and, if you cannot, isolate.
Three kinds of store owner, three different next steps
The owner with a good host
Your host manages PHP and has already patched it. Your task is to verify. Ask for written confirmation, check the version, then place a test order to make sure nothing broke. Add a calendar reminder to repeat this check after every future alert.
The owner on a basic plan
You choose your PHP version in the control panel. Take a backup, update plugins and theme, switch to a supported patched version and test checkout. If something breaks, switch back temporarily and fix the plugin that caused it.
The owner on an old version or an old theme
You may find that moving to a supported PHP version breaks the store because the theme or plugins are no longer maintained. This is the hardest case. You can pay for repairs, or you can decide that the store has reached the end of its life and rebuild on something maintainable. This is where the second half of this article matters.
Repair or rebuild: a clear-eyed comparison
Repairing an old store means paying a developer to modernise the theme, replace abandoned plugins, fix compatibility and test. It is sensible when the store is simple, the design is fine and the cost is a fraction of a rebuild.
Rebuilding means moving products, customers and orders to a new platform designed for today. It is sensible when the old store is slow, depends on many fragile plugins, cannot support your business rules or keeps needing emergency fixes.
Use these questions to decide:
- How much would repairs cost compared with a rebuild?
- How long will the repaired store last before it breaks again?
- Does the store support what the business needs next year: B2B pricing, an app, new countries?
- Who will maintain it, and is that person reliable?
- How much has downtime or slowness cost in lost orders?
If repairs cost more than half of a rebuild, or if the store cannot support your next stage, rebuilding usually wins.
What “safer” really means
No platform is unhackable. A safer setup has four qualities:
- Fewer parts. Every extra plugin or library is something that can break or be attacked.
- A maintained foundation. Languages, frameworks and libraries are on supported versions and patched promptly.
- Clear ownership. A named team handles patching, backups and monitoring and tells you what they did.
- Fast recovery. Tested backups and a plan mean that when something goes wrong, you recover in hours, not weeks.
A platform that does not run PHP is not exposed to these particular PHP flaws. That is a fact, but not a guarantee of safety. The habits matter more than the logo.
What a migration looks like
A careful migration is less scary than it sounds.
- Review. We look at your current store, products, customers, orders, plugins, traffic and search rankings.
- Plan. We agree scope, timeline and what will change, such as design and checkout improvements.
- Build. The new store is created on a staging address while the old store keeps selling.
- Import. Products, customers and orders are moved and checked.
- Redirects. Old addresses are mapped to new ones so search rankings and bookmarks continue to work.
- Test. Payments, shipping, tax, emails and mobile behaviour are tested on real devices.
- Switch. We go live at a quiet time with a rollback plan.
- Watch. The first days are monitored closely.
What you gain beyond security
- Speed. Faster pages mean more completed orders on mobile.
- A better checkout. Local payments, shorter forms and clear delivery information.
- Room to grow. B2B pricing, multi-country selling and marketplace features when you need them.
- An Android and iOS app. On the same back end as the store.
- Less stress. A team that handles the technical chain so alerts become routine.
Questions to ask any provider you consider
- Which languages and frameworks does the platform use, and who maintains them?
- How quickly do you apply security fixes, and how do you tell customers?
- Where are backups stored and when did you last test a restore?
- Do I own the code, accounts and data?
- What is your written response time for emergencies?
- Can you show live stores and speak to clients?
How NNT Software can help
N & T Software Private Limited builds and supports NNT Mart, an e-commerce platform for stores, B2B portals, marketplaces and mobile apps.
- Review of your current store: PHP version, plugins, speed, risks and a plain-language recommendation.
- Emergency help: patching, testing and break-in checks if you need them now.
- Migration from WordPress and WooCommerce with products, customers, orders and redirects handled and tested.
- A faster, mobile-first store with the payment methods your customers use.
- Android and iOS apps on one back end.
- Ongoing care with patching, backups and monitoring agreed in writing.
Send us your website address through the contact form or WhatsApp on this page. We reply within minutes with what we see and what we would do first.
How NNT Software can help
If you decide to move off an ageing WordPress or WooCommerce store, NNT Software can plan the migration of products, customers and orders, map old addresses to new ones, rebuild checkout for mobile and connect your courier, accounting or ERP systems. The new store runs on a headless, API-first NNT Mart back end with cloud deployment and monitoring, so future alerts are handled by a team rather than by you.