Back To Insights
Published On October 22, 2026
Author Stephen Ramkissoon
Share
Categories
Website Maintenance
On October 21, 2026, the group that maintains PHP released fixes for two critical security vulnerabilities that could affect any website running on PHP, including most WordPress websites.

Quick answer: On October 21, 2026, The PHP Foundation released fixes for two critical security vulnerabilities that could affect any website running on PHP, including most WordPress websites. If Marketing Guardians looks after your website, your hosting provider has already applied the fix and there is nothing you need to do. If you manage your own hosting, ask your host to confirm in writing that your site runs PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. If it doesn't, have them upgrade it.

Key takeaways

  • PHP is the behind-the-scenes scripting language that builds most WordPress sites, and close to 70 percent of websites use it.
  • Two vulnerabilities, each rated 9.2 out of 10 for severity, could have let an outsider run malicious code on a web server without authentication.
  • The PHP Foundation says there are no complete workarounds, so installing the update is the only safe fix. Updating WordPress or plugins does not change this.
  • Artificial intelligence has shortened the gap between a vulnerability becoming public and someone being able to use it, which is why hosting companies moved so quickly.
  • If Marketing Guardians looks after your website, the fix has been applied and you do not need to do anything.

What is PHP, and why does my website depend on it?

PHP is code that runs on a web server and builds a page every time someone visits. When a visitor opens your website, PHP collects your content from a database, combines it, and delivers the finished page they read. Visitors never see it, but they rely on it with every click.

It is also everywhere. According to figures from the web research firm W3Techs, reported by PCWorld, close to 70 percent of websites with a known server-side language use PHP. Around 40 percent of all websites run on WordPress, which is built on PHP. That is why a vulnerability in PHP becomes a story for ordinary business owners and not only for developers.

What happened on October 21, 2026?

The PHP Foundation announced on October 20 that a security release was coming, and it published the fixes on October 21. They address two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, and the group rated both 9.2 out of 10 for severity.

In everyday terms, the vulnerabilities could let someone with no login run their own instructions on a web server. The PHP Foundation said the risk covers all PHP installations that serve web pages. It also said there are no complete workarounds and that updating is the only safe choice.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Because the problem lives on the server rather than inside WordPress, updating your plugins or themes would not have solved it. The fix has to be applied by your web host.

Why is this such a big deal?

There are two main reasons: the number of websites involved, and how quickly a vulnerability like this can now be put to use.

Scale. With so much of the web built on PHP, a vulnerability this widespread touches a very large number of sites. PCWorld described the worst case this way: if the vulnerabilities were left unpatched, more than half the internet could have been at risk. That is a hypothetical, not a report that half the internet was attacked, and PCWorld's coverage did not confirm attacks on specific sites.

Speed. Researchers at the security firm Wiz used advanced AI models to find the vulnerabilities and to build working exploits. Wiz said the bugs had sat in PHP for more than a decade, and that one researcher using AI could turn them into a working exploit in about a week. It estimated a world-class security team might once have needed months for the same job.

The lesson is not that your website was attacked. It is that the window between a vulnerability becoming public and someone trying to use it keeps shrinking, which is why hosting companies moved within hours instead of weeks.

Which websites were affected?

Any website running on an unpatched version of PHP could have been exposed, whatever its size or industry. Some sites went offline briefly while their hosts applied upgrades, including government websites in the Netherlands, France and Germany, according to Reuters as reported by PCWorld.

Website builders that run everything for you, such as Shopify, Squarespace, Wix and Webflow, typically manage server updates on their own side. If your site is on one of those platforms, their status pages are the best place to check.

Does my website need anything done?

For Marketing Guardians clients, no. We work with each of our hosting providers, and they have applied the security update to your website's server. Several also put additional protective measures in place. You do not need to change passwords, install anything or take any action.

In the coming weeks we will also move a small number of older websites to a newer version of PHP as routine maintenance. If yours is one of them, we will contact you directly and handle it for you.

If you manage your own hosting, here are three quick steps.

  1. Find your PHP version. In WordPress, open Tools, then Site Health, then the Info tab, and look under Server.
  2. Compare it with the fixed versions: 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or anything newer.
  3. If your version is lower, or you are on PHP 8.1 or older, ask your host to confirm in writing that the fix is in place, or to upgrade you.

A short written reply matters because some hosts apply a fix without changing the version number you see. It is also a good moment to confirm that you have a recent backup of your website.

What about older versions of PHP?

PHP 8.1 and older no longer receive updates from the PHP project. Some hosts and long-term support vendors supply their own fixes, and the PHP security team published limited backports for versions 7.4, 8.0 and 8.1 for people who build PHP themselves.

The safer long-term answer is moving to a supported version. PHP 8.2 also reaches end of life on December 31, 2026, so PHP 8.3 or newer is a better target than 8.2 for any upgrade you plan now.

Frequently asked questions

What is the PHP security vulnerability in simple terms? Two serious vulnerabilities in PHP, the scripting language behind most WordPress pages, could have let someone run malicious code on a web server with no password or authentication needed. The PHP team released fixes on October 21, 2026.

Has my website been hacked? Nothing in the announcement suggests any particular website has been compromised. It is a reason to confirm the update is in place, not a reason to panic.

Do I need to update WordPress or my plugins? Keeping them current is always good practice, but those updates do not change your PHP version. This fix happens on the server, which is the job of your hosting provider.

How can I tell if my website is patched? Check your PHP version under Tools, then Site Health, then Info, then Server, and compare it with 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Then ask your host to confirm in writing, because some hosts patch without changing the number.

Could the update break my website? Moving between recent PHP versions is usually smooth. Larger jumps from very old versions deserve a test on a staging site first, which your developer or Marketing Guardians can set up.

Did artificial intelligence cause this? No. The bugs had existed for more than a decade. Researchers used AI to find them and build working exploits much faster than before, and the same tools can help attackers, which is why speed matters now.

Does this affect Shopify, Wix or Squarespace? These platforms typically manage server updates themselves. Their status pages are the best place to confirm.

Sources

AI search is changing fast. Download our Playbook to make sure you keep up.

AI search is changing fast. Download our Playbook to make sure you keep up.

Inside our AI Search and GEO Playbook, you’ll find a readiness checklist and a few copy-and-paste building blocks:

  • Add Organization, Person, and Service schema to your About and Services pages.
  • Add a short FAQ to your top service page with two or three real customer questions.

Small changes like these help AI systems understand who you are, what you do, and when to reference you.

Where to start if you feel behind? Just begin with one page - one question - one clear answer. Then open the Playbook and pick the next small step. Consistency beats intensity here. Your future self will be glad you started this month.

Back To Top