PHP has released an emergency security update to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October.
WordPress runs on PHP, so if you have a WordPress site, this is relevant to you. Here’s what it means, and why I’d take your site offline until it’s patched.
PHP’s security advisory has the full details.
What’s happened
Both flaws are remote code execution bugs. That means someone could run their own code on your web server without logging in. It’s about as serious as a website vulnerability gets.
Usually the fix and the details come out together. This time, details leaked before the patch was ready, along with an exploit tool people are calling PHP2Shell. Sansec reports that Cloudflare saw early attacks against PHP sites on the morning of 21 October.
Now that the fix is out, PHP has published the technical details in two advisories, one for CVE-2026-109618 and one for CVE-2026-109619. That makes it easier for attackers too, so the time between the release and your server being updated matters.
Which sites are affected
PHP says every installation that serves web pages is at risk until it’s updated, whichever way the server runs PHP. It considers the risk highest on servers using Apache with mod_php, where an attack can work before any of the site’s own code runs.
The problem is in PHP itself, not in WordPress, your theme, or your plugins. That has two consequences:
- Updating WordPress won’t fix it. PHP has to be updated on the server.
- Security plugins most likely won’t stop it. They run inside WordPress, and the attack can happen before WordPress has started.
Astro sites aren’t affected
Static sites built with Astro don’t run PHP, so this vulnerability doesn’t apply to them. The pages are built in advance and served as plain files, so there’s no PHP on the server for an attacker to reach.
The exception is an Astro site that pulls its content from WordPress, often called headless WordPress. The visitor-facing site is still safe, but the WordPress install behind it runs PHP and needs patching like any other.
Check your PHP version
In your WordPress dashboard, go to Tools, then Site Health, then the Info tab. Open the Server section and look for PHP version.
A patched site will show 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or higher. Some hosts and Linux distributions apply the fix to their own builds without changing the version number, so if yours shows something lower, ask your host to confirm whether it’s been patched.
Older PHP versions
PHP only releases official updates for supported versions, which are currently 8.2 and above. If your site is on 8.1 or older, there’s no official release for it.
Because of how serious this is, the PHP team has also published fixes for 7.4, 8.0 and 8.1 that hosts can apply themselves, and some Linux distributions provide their own. Ask your host whether your server is covered.
Either way, an old PHP version is worth moving off. PHP 8.2 also stops getting security fixes on 31 December 2026. Moving up a version can break older themes and plugins, so test it on a staging copy first if you can.
What to do today
Take your site offline until it’s patched
My advice is to take your site offline now and bring it back once PHP has been updated on the server. If you use a managed hosting provider, reach out to them directly for confirmation.
It’s not a decision to make lightly if your site takes orders or bookings. But the attack details are public, and PHP says none of the workarounds make a server safe. A few hours of downtime costs a lot less than a hacked server.
A WordPress maintenance mode plugin won’t do the job, because it still runs on PHP. The site needs to stop running PHP altogether. Your host can usually suspend the site or serve a static holding page in its place, so ask them to do that.
If your host manages PHP for you
This covers most shared and managed WordPress hosting. Applying the patch is your host’s job, but it’s worth checking they’re on it. Ask them:
- Have they updated PHP to a fixed version yet?
- If not, can they take the site offline, or serve a static page, until they have?
- If your site is on PHP 8.1 or older, what’s their plan?
If your site uses Cloudflare
Cloudflare has added firewall rules for all customers, including free plans. That helps, but only for traffic that goes through Cloudflare. If someone finds your server’s real IP address, they can go around it.
Whoever hosts your site
Make sure you have a recent backup stored somewhere other than the server. If the worst happens, a clean backup is what gets you back online.
After the patch
When your host confirms the update, bring the site back online and check Site Health again to see the new PHP version.
It’s also worth a quick look for anything unusual, such as admin users you don’t recognise or plugins you didn’t install. Attacks were reported before the fix came out, so a site that was online this morning may already have been targeted.
If you need a hand
If you’re not sure where your site stands, or you think something’s already wrong, I offer emergency WordPress support to check and fix it.
Keeping PHP and the server up to date is also part of WordPress support and maintenance, so that next time it isn’t something you need to chase.
Frequently asked questions
Does this affect my WordPress site?
Yes, unless PHP on your server has already been updated. WordPress runs on PHP, and PHP says every installation that serves web pages is at risk until it's updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a patched build from your host.
Will updating WordPress or my plugins fix it?
No. The flaws are in PHP itself, which runs on the server underneath WordPress. The fix is a PHP update, which is usually your host's job.
My host manages my server. Do I need to do anything?
Contact them and ask whether they've updated PHP to a fixed version, and whether they can take your site offline or serve a static page until they have. If your site is on an older PHP version, ask what they're doing about it.
Should I take my site offline?
Yes, until PHP on your server has been patched. The details of the attack are now public and none of the workarounds are guaranteed. A maintenance mode plugin won't help, because it still runs on PHP, so ask your host to suspend the site or serve a static holding page.
My site runs PHP 8.1 or older. What should I do?
PHP isn't releasing official updates for 8.1 and older. Because of how serious this is, the PHP team has published fixes for 7.4, 8.0 and 8.1 that hosts can apply themselves, and some Linux distributions provide their own. Ask your host whether your server is covered. Either way, plan a move to a supported version, and test your theme and plugins on a staging copy first, as older code can break on newer PHP.