A critical patch shipped last Tuesday. Did it reach your site?

Your website took a booking last Tuesday. On that same Tuesday, a critical patch shipped for the software underneath roughly two in five websites on the internet. Here is the uncomfortable question: do you know whether it reached yours?

Most owners I ask cannot answer. Not because they are careless — because nobody ever gave them the means to answer. That gap is the subject of this piece. The patch itself is almost a footnote.

What shipped on 22 September

The WordPress project released version 7.1.2, fixing CVE-2026-87902. WordPress’s own advisory rates it 9.2 out of 10 — Critical.

The flaw, in the advisory’s exact words: an unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories, and if pre-conditions for both the server environment and the active theme are met, this can lead to RCE.

Plainly: under the right conditions, somebody with no account and no password could get a site to run code it was never meant to run.

WordPress is not the weak link

It would be easy to turn this into a post about WordPress being unsafe. That post would be wrong, and any technical reader would know it within a paragraph.

Look at what actually happened. The flaw was found, fixed and shipped on the same day. The fix was carried back through every branch still eligible for security updates — as far back as 4.7, a line that first shipped years ago. That is 25 separate releases cut so that nobody running an old site would be left without a patch. Minor security updates are enabled by default, and the project’s own administration handbook strongly discourages turning them off. Sites configured for automatic background updates began updating themselves.

Open-source software with a security process that responsive is not the problem here. If anything, the backport effort is the most impressive part of the story and the part nobody will write about.

So what is the weak link?

It is a question, and it is about paperwork rather than code.

Say you run a braiding studio, a barbershop, a catering business. Your website takes bookings. Somebody built it for you, maybe two years ago. Last Tuesday a critical patch shipped for the platform underneath it.

Did it reach your site?

Follow that question honestly and it turns into four. They are not technical questions. Every one is answerable in about a minute, by you, without help:

1. Can you log into your own hosting right now? Not email someone who can. You, with credentials you hold.
2. Whose name is the domain registered in? Yours, or the agency’s?
3. Who has a copy of the source code? If your developer stopped answering tomorrow, what do you actually have?
4. Who applied the last security update, and when? Is there anyone whose job that is?

If you cannot answer those four, you do not own a website. You rent one. And renting is perfectly fine right up to the moment something needs fixing — at which point you are waiting on whoever holds the keys, on their schedule, at their price.

This next part is reasoning, not reporting

I want to mark the join, because this is where writing about a security release usually stops being about the security release and starts being a sales pitch wearing its clothes.

Nothing in the advisory says anything about who should own your domain. It is a patch note. What it establishes is narrower: software underneath a large share of the web needs occasional urgent attention, and that attention has to come from a named person.

The step from there to “so you should hold your own logins” is ordinary logic rather than a finding, and you can check it yourself. A patch reaches your site because something automatic applied it, or because a person did. If it was automatic, fine — until the release that needs a human. If it was a person, you had better know which person, and be able to reach them, and be able to get in yourself if you cannot.

None of that requires you to become technical. It requires the accounts to be in your name. It rhymes with something I wrote about earlier this month: whether an AI can recommend a business that actually exists comes down to whether there is a real page anywhere to retrieve — and the same question applies to who that page belongs to.

What ownership actually means, including what it costs

What I build is a complete business website where the domain, the hosting, the source code and every connected account are registered in your name. Not mine. Online booking that takes a deposit up front, an owner’s dashboard so you can see what is happening without asking anyone, built mobile-first because that is where your customers are. Fixed scope, no monthly website subscription.

Now the limits of that promise, because overselling it would be the same mistake as overselling the WordPress story.

Owning your website does not make it free to run. A domain costs money every year. Hosting costs money every month. Stripe takes its percentage of every payment. Anything doing AI work has usage costs. Nobody can build you a system with no running costs, and anyone telling you otherwise is selling you something.

What changes is whose name is on it. Those are your accounts, on your card, visible to you whenever you want to look. The scope is agreed before we start, so the cost is predictable rather than open-ended. And when a patch like last Tuesday’s lands, there is one named person responsible for it — and nobody else holding your logins.

One running live

muriellehairbraids.com is a braiding business taking real bookings and real deposits on a site she owns outright — domain, hosting, code and accounts all in her name. Open it on your phone and go as far as the deposit screen.

That is the whole difference. Not that her site is invulnerable; no site is, and I would not claim it. But when something needs patching there is one person to call, and if she ever wants to, she can get into every account herself.

The takeaway

Security patches are not the interesting part of running a small business, and they never will be. You should not have to think about them.

But you should be able to find out. And it turns out that “can I find out?” is the same question as “do I own this?” — asked in a way you can actually answer on a Tuesday afternoon.

Common questions