Published
·
Updated
·
4 min
read
Is your WordPress site safe? The October 2026 PHP flaws explained
Two critical PHP flaws were fixed on 21 October 2026. Here is what they mean for your WordPress site, how to check if you are affected and what to ask your host today.
TL;DR
On 21 October 2026, PHP released fixes for two critical flaws. PHP is the programming language WordPress runs on.
The flaws can let an attacker take over a web server without logging in.
Updating WordPress or your plugins does not fix this. Your host has to update PHP on the server.
The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ask your host to confirm one of them today.
Sites on Framer and Webflow need no action.
If you have a WordPress site, you have probably seen headlines about PHP this week. Here is what happened in plain words, and the one message to send your host today. We wrote this on 22 October 2026 and will update it as the situation changes.
Update, 23 October: The picture is mixed. Sansec now thinks mass attacks are less likely, because the public exploits do not work on a standard PHP setup. But Amazon says attackers tried the flaws as early as 17 October, before they were made public, and VulnCheck has built an exploit that works on a typical live server. Our advice is unchanged: make sure PHP on your server is updated.
What happened on 21 October
PHP is the programming language behind WordPress, WooCommerce and many other website systems. It is installed on your hosting server, not inside WordPress, so it runs underneath everything your site does.
On 21 October the PHP team released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which researchers have named PHP2Shell. According to the official PHP security advisory, both can let an attacker run their own code on the server without logging in. One demonstrated attack needs a single request and works before WordPress even starts. Someone who gets that far can change your site, steal data or send spam from your server.
Details leaked a day before the planned release. The security firm Sansec reports that attacks had already started before the fixes were public, and CERT-EU's security advisory tells organisations to patch immediately.
Is your site affected?
The answer depends on what your site is built with.
Your site | Affected? | What to do |
|---|---|---|
WordPress or WooCommerce | Yes, until your host confirms the update | Write to your host today |
Another PHP system, such as Joomla, Drupal or PrestaShop | Yes, until your host confirms the update | The same |
Framer or Webflow | No action needed | Nothing, the platform runs and updates its own servers |
Old or forgotten sites on the same hosting account | Probably | Check them along with your main site |
This affects a large part of the web. On 21 October, about 69% of internet facing PHP servers that show their version were running old versions that will never get an official fix, according to OX Security. Those versions no longer get regular fixes from the PHP project.
Not sure what your site runs on?
What to do today
Updating WordPress, your theme or your plugins will not fix this. The flaws are in PHP itself, so the fix is a PHP update on the server. For most small business sites, that is the job of your hosting company or whoever looks after your site.
Send them this message:
Hello, on 21 October PHP released urgent security fixes (CVE-2026-109618 and CVE-2026-109619). Could you confirm which PHP version our site runs, and that it is now 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a version that includes the fix? If we are on PHP 8.1 or older, what is the plan to move us to a supported version?
What their answer means:
A fixed version. You are done with this one.
PHP 8.1 or older. The PHP project no longer updates these versions. Some hosts add the fix themselves, so ask, and plan the move to a supported version either way.
PHP 8.2. It stops receiving security fixes on 31 December 2026, so plan the next upgrade now.
Check your old and forgotten sites too, for example a test copy, an old landing page or a site you no longer use that still runs on the same hosting account. Any of them can give an attacker a way into the whole account. If nobody needs a site, ask your host to switch it off.
The longer term
Security updates are a normal part of running WordPress. Most are small. This one was not, and it showed how much depends on someone watching the server for you.
Hosted platforms such as Framer and Webflow take that job off your plate, because the platform runs and updates its own servers. They are not the right choice for every business. If keeping WordPress up to date is a job nobody in your team owns, they are worth a look. Our guides to moving from WordPress to Framer and from WordPress to Webflow explain what a move involves.
Frequently asked questions
I updated WordPress and all my plugins. Am I safe?
Not from this one. The flaws are in PHP, which runs on the server underneath WordPress. Keep updating WordPress, and ask your host about the PHP version.
How do I check which PHP version my site uses?
In your WordPress dashboard, go to Tools, then Site Health, open the Info tab and expand Server. The PHP version is listed there. The number alone does not show whether your host added the fix to an older version, so confirm with them.
My site is on Framer or Webflow. Do I need to do anything?
No. These platforms run and update their own servers, and there is no PHP on your side to update.
My host says I am on PHP 8.1 or older. What now?
Ask whether they have added the fix to your version, because some hosts do. Either way, ask them to move you to a supported version soon, and check your site afterwards. Older themes and plugins can break on newer PHP.
How do I know if my site has been hacked?
Often you cannot tell from the outside. Ask your host or developer to check for unknown files, recently changed files and new admin accounts. If they find something, change your hosting, database and WordPress passwords once the site is clean.
