PHP disclosed two critical security vulnerabilities on 21 October 2026. Updates that fix the problem are already available. If your website runs on PHP, like almost every WordPress site, the key step is simple: ask your hosting provider or website administrator whether the update has been applied.
What is going on?
PHP is the software a large share of all websites run on, including WordPress and WooCommerce. Two serious flaws were found in it (known as CVE-2026-109618 and CVE-2026-109619). Under certain conditions, they let an attacker run commands on a server remotely, without logging in.
That sounds alarming, and it is serious. But it does not mean your website has been hacked. It means servers that have not been updated yet are at risk.
The flaw is not in WordPress or a plugin, but in the underlying server software. So the fix usually isn't up to you, but to whoever manages your server.
How serious is it?
The Dutch NCSC reported on 21 October that demonstration code is available online. At that point no active abuse had been seen. That can change, so waiting is not a good idea.
Some hosting providers temporarily took websites offline to apply the updates safely. Was your site briefly unreachable? Then it was most likely a precaution, not a sign you were hacked. Your own host's status page or message has the most up-to-date information.
What should you do now?
- Find out who manages your server. Usually your hosting provider, sometimes an agency or your own IT administrator.
- Ask whether the PHP security update of 21 October has been applied. Mention both CVE numbers so your administrator knows exactly what you mean.
- Don't forget other websites. Think of an old test site, a separate subdomain or a second web shop.
- Check your website after the update. Do your contact form, login, ordering and payments still work?
- Notice anything odd? Unknown users, changed pages or strange redirects? Have your administrator investigate possible abuse.
What you don't need to do
- Don't take your website offline in a panic. Leave that to your host or administrator, who can judge whether it's needed.
- Don't assume a WordPress or plugin update fixes this. That's still good maintenance, but this flaw sits one layer deeper.
- Don't change settings yourself based on a news article. The real fix is the official update.
- Don't assume you're safe because your website works. Being online says nothing about whether the update was applied.
Running an old PHP version?
Then now is a good time to deal with it. PHP 8.1 and older no longer get regular updates. Emergency fixes were made for these flaws, but an old version remains a risk for future vulnerabilities. In WordPress you can see your PHP version under Tools → Site Health → Info → Server. Ask your host to move to a supported version.
For your administrator: the fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (or newer). Some hosts apply the fix to their own packages, so the version number may differ. In that case, ask for confirmation that both flaws are fixed.
Frequently asked questions about the PHP vulnerability
Has my website been hacked?
Probably not. The flaw makes an attack possible, but is no proof that anything happened. If in doubt, ask your administrator to check.
Does this affect WordPress?
Yes, indirectly. WordPress runs on PHP. The fix is on the server, not in WordPress itself.
Do I need to install anything myself?
Usually not. With regular web hosting, your hosting provider applies the update. If you have your own server or VPS, that responsibility lies with you or your administrator.
Does an update prove nothing happened?
No. An update closes the hole, but says nothing about what happened before. If in doubt, a separate investigation is needed.