# PHP Vulnerabilities

**URL:** https://discourse.wota.xyz/t/php-vulnerabilities/657
**Category:** Website
**Created:** [22 October 2026 12:51 UTC](https://discourse.wota.xyz/t/php-vulnerabilities/657 "2026-10-22T12:51:28Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![M5TEA](https://discourse.wota.xyz/user_avatar/discourse.wota.xyz/m5tea/32/754_2.png) [@M5TEA](https://discourse.wota.xyz/u/M5TEA)
#### Post date: [22 October 2026 12:51 UTC](https://discourse.wota.xyz/t/php-vulnerabilities/657/1 "2026-10-22T12:51:28Z")

</div>

You might have seen in the news there are some critical vulnerabilities relating to PHP which is the language the main WOTA website uses (the discourse server is unaffected).

The main site uses something called a CMS which is a framework on which the site has been constructed. It has not really been updated since the site was first created, so the CMS software is very out of date as is the version of PHP that is used.

As a result there is very little that can be done _if_ a vulnerability was announced that affects the site to mitigate risks. As it happens in this case it is upload functionality that is exploited, and we don’t do that with the main site. What settings I can change have been changed, but again they are mostly irrelevant due to the very old version of PHP in use.

Please let me know if you experience any oddities using the main site moving forward.

Regards, Mark.