You may have seen news this week about two critical security flaws in PHP, the programming language behind WordPress and many other websites. The flaws can let attackers take over a web server without logging in.
What Happened With PHP
On October 21, 2026, the PHP project released updates that fix both flaws. Any site built on PHP, including every WordPress site, needs that update on the server where it’s hosted. Usually, your host or web developer applies it.
Why Scorpion Websites Aren’t Affected
Your Scorpion website runs on Scorpion’s proprietary platform, not WordPress, and it isn’t built on PHP. There’s nothing for you to update, patch, or ask a host about, and your site is up and working as usual.
This is one of the reasons we built our own platform, designed specifically around how law firms and home services businesses win new clients and customers. We control the whole development environment, from the code to updates to security, so you don’t have to keep track of issues like this.
That same control lets us build sites to act as the hardworking core of your entire marketing system. Your ads land on pages designed to convert, search is built into the site structure, and lead capture tools run across every page. Learn more about Scorpion websites.
What to Do if Your Site Runs on WordPress
If your site is on WordPress, or you aren’t sure what it runs on, a quick email or call to your host or developer will get you an answer. The fix is a PHP update on the server, not a WordPress update, so they’re the ones to ask:
Has the October 21 PHP security update been applied to my site?
Is my site on a version of PHP that still gets updates? If it’s on an older version, ask about the plan to upgrade.
Who to Contact With Questions
If you’re a Scorpion client, reach out to your Scorpion Account Manager. If your site lives somewhere else and you want to talk through your options, contact us and we’ll walk you through it.
