On 21 October PHP shipped a security update for two critical flaws. They can let someone run code on your server without logging in. That is in the security advisory on php.net (opens in new tab), and PHP's own advice is to update immediately.
Why this matters to you: WordPress and WooCommerce run on PHP. If you have a WordPress site or shop, the server almost certainly runs PHP too. The flaw is not in WordPress, a plugin or your theme. It sits one layer deeper.
Which versions are safe
The safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything below those in each branch is vulnerable. The flaws are CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2.
According to PHP, every installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php, where PHP demonstrated an attack that needs a single request, before WordPress itself runs any code.
PHP 8.1 and older no longer get updates from the PHP project. This time the security team did publish small source patches for 7.4, 8.0 and 8.1, and some Linux distributions and hosts ship their own fixes. You have to ask for those.
Also worth knowing: PHP 8.2 stops getting security fixes after 31 December 2026. If you plan an upgrade now, go straight to 8.3 or newer.
CERT-EU gave the same advice on 21 October: find out where PHP runs and patch right away (advisory 2026-018 (opens in new tab)). The US cyber agency CISA goes further: patch immediately (opens in new tab), and if you cannot, or you still run PHP 8.1 or older, take those systems offline until they are updated.
And attackers are already trying. Amazon saw a first attempt in its honeypots on 17 October, four days before disclosure, followed by broad attempts from several actors (AWS Security Blog (opens in new tab)). Security firm Sophos withdrew an earlier report of a successful break-in (Sophos (opens in new tab)), but on 22 October the Dutch National Cyber Security Centre did receive signals of successful abuse (NOS (opens in new tab)). Dutch minister Van Weel says the impact could be significant. No stolen data is known so far, and the Dutch Data Protection Authority had not yet received any data breach notifications (ND (opens in new tab)). So waiting is no longer an option.
What it means for your WordPress site
Most small businesses host their site with a hosting company. The host decides which PHP version runs and when it gets updated. You usually cannot patch PHP yourself. Your host can.
That is where I see the risk. Good hosts patch the same day. Cheap plans, or servers once set up by a freelancer, sometimes go untouched for weeks. And if you still run PHP 8.1 or older, you depend on a host that backports fixes itself. If it does not, moving to a newer PHP version is the only real answer, and that needs a quick test to see whether your theme and plugins cope.
A WordPress update does nothing here. A security plugin does not really help either, because it runs on PHP itself.
The flaw is not in WordPress. It is in the engine underneath, and your host runs that engine.
PHP does list temporary settings that reduce exposure, such as a lower post_max_size and switching off session.upload_progress. That is work for your host or developer, and PHP says clearly that it does not replace the update.
Sites built on Next.js and Vercel, like the ones I build now, do not run PHP, so this flaw does not affect them. I mention it not to sell, but because the technology under your site changes your risk picture.
What to do now
- Find out which PHP version your site runs. In WordPress it is under Tools, Site Health, Info tab, Server section.
- Does it say 8.5.12, 8.4.27, 8.3.36, 8.2.35 or higher? Then your host is up to date. Anything lower: email or call your host today and ask when the update goes live.
- If you are on PHP 8.1 or older, ask whether your host applied its own fix. If not, plan an upgrade this week. Staging first, then live.
- Check that you have a recent backup stored outside your hosting plan.
- After the update, check that your site, checkout and forms still work.
Where to start
Not sure who hosts your site, or who has the keys? This is a good moment to find out. That is often the real problem: not the flaw, but that nobody feels responsible.
If you want me to look at your hosting and PHP version, or at what it takes to leave an outdated setup behind, get in touch.