WordPress warns site owners to update PHP immediately or take servers offline

WordPress has issued a security alert over a severe PHP vulnerability, urging website owners to update PHP as soon as possible and check with hosting providers on patch deployment and Web Application Firewall, or WAF, mitigation rules. The notice said users can review the PHP version currently running on their sites through the WordPress admin dashboard. It also noted that versions earlier than PHP 8.2 no longer receive official security updates. For websites still running older PHP versions on self-managed servers, WordPress said operators that cannot complete remediation right away should consider temporarily taking those servers offline until the vulnerability is effectively mitigated. The warning focuses on immediate operational steps rather than broader impact, with the company pointing site owners to version checks, patch confirmation, and temporary shutdowns where needed.