Check your software for security updates
Oct 23, 2026
Free prompt. No sign-up needed.
On 21 October 2026, WordPress.org alerted website owners to two critical security flaws in PHP, the software that runs WordPress and many other websites. The fixes belong in PHP, so updating WordPress or its plugins alone does not address this alert. If you manage a website, check with your host or developer that the relevant PHP fixes have been applied.
There have also been separate security releases, including Node.js updates. These notices are not evidence that every app or business has been breached. Some of the software worth checking sits behind the tools you use for video, transcription and automation, rather than appearing as an app you open yourself.
The free prompt below helps you check what is relevant to your own setup: installed apps, operating system, browsers, supporting software, websites and authorised cloud services. Copy it into Claude or ChatGPT. It asks for a read-only inventory, checks current official advice, and explains priorities and anything it cannot verify. It must ask for your approval before making changes.
To inspect your software, use Claude with computer access (Claude Code or Cowork) or ChatGPT Codex, and give it permission to access your computer. Ordinary chat without that access cannot inspect installed software. If computer access is unavailable, ask for guided manual checks instead. You can also pass the findings to your IT support or website developer.
Copy the security-check prompt
Select and copy all the text in the box below.
Review my whole tech setup for relevant security updates and recent security incidents, not just AI or video tools. Start with a read-only inventory of installed apps, operating-system updates, runtimes, dependencies and browser extensions. Identify versions, installation locations, separate copies and the versions my tools actually use where you can verify them. Node.js, FFmpeg, Chrome or Chromium and HyperFrames are examples, not the limit of this check.
Include the websites I manage, their CMS, plugins and themes, such as WordPress and Rank Math where installed, plus the connected cloud services and providers I use and authorise you to inspect. Ask which websites and services I use if that is unclear. Use only accessible, authorised read-only information. Don’t explore unrelated accounts or access secrets.
Compare the inventory with current official security advisories, release notes and relevant recent incident notices. Use web search for current official advisories. If you can't browse, say so and don't rely on memory. Distinguish software needing a local update from a hosted-service or provider incident requiring an account-specific response. Don’t assume a named product is affected without checking the version, configuration and advisory scope.
Don’t run potentially compromised software or an infected environment just to identify a version. For Python environments, identify package versions by reading folder names in site-packages (for example litellm-1.107.0.dist-info), not by running pip or Python. Don’t read passwords or access keys, or change anything yet. If compromise is suspected, pause routine updates and credential rotation until you have verified the official containment guidance and proposed safe next steps for my approval.
Report confirmed affected versions, missing fixes, unsupported software and anything you couldn’t inspect or verify. Give official sources and plain-English priorities, separating confirmed findings from uncertainty. Don’t treat an installed vulnerability as proof of a breach, promise an exhaustive scan or claim the whole setup is secure.
Propose compatible fixes that preserve my projects and settings, with backups where appropriate. Explain risks, required restarts and any provider-specific actions, then ask for my approval before making changes. Never bypass security warnings.
After approved updates, tell me to save my work and restart affected apps or the computer where needed. Verify the installed versions and the versions my tools actually use, and report anything still unverified. If you don’t have access to inspect an area, say so and give me safe manual steps instead of guessing.Before you make changes
- Never paste passwords, API keys or recovery codes into a chat. If an approved update needs your password, enter it yourself only in the genuine system or app prompt.
- Save your work before restarting. After approved updates, restart where needed and verify the versions your tools actually use.
- This is a starting point, not a complete security audit or a guarantee that your setup is secure. If the check finds a compromised release or signs of a breach, updating alone may not be enough. Pause and follow the provider’s incident-response guidance or get qualified technical help.
WordPress and PHP: This follows the critical PHP security release of 21 October 2026. Read the WordPress.org News notice and the PHP.net security advisory.
Official sources: Examples include the Node.js security release notice and Chrome desktop release notice. These do not mean every reader is affected. Check the current advice for your actual software and versions.
Further official guidance: LiteLLM’s compromised-release report, the Australian Cyber Security Centre’s PHP alert, the NCSC’s PHP security alert, and NCSC guidance on keeping software up to date.
Sources checked 23 October 2026.
Get practical AI ideas for your business
Join Deb Szabo's weekly AI for Business Growth newsletter for practical ways to use Claude and AI across your business.
We hate SPAM. We will never sell your information, for any reason.
