Critical PHP flaw: what it means for your WordPress site

On 21 October 2026 the PHP team released an emergency security update for two flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10. PHP is the language WordPress runs on, so the problem touches almost every WordPress site, every WooCommerce shop and most older sites on shared hosting.

The flaw is not in a plugin or a theme but in PHP itself. It affects every installation that serves web pages, with PHP-FPM, Apache mod_php, LiteSpeed and other setups. According to Patchstack and Cloudflare, the first attack attempts were seen on the morning of the same day, before the fix was even out.

The reactions showed how serious it was. In the Netherlands and Finland, government websites, among them the Dutch parliament and the national cyber security agency, were taken offline as a precaution until the update was in place. Hosting companies across Europe did the same or put temporary protections in front of their servers.

The key point for you: updating WordPress or its plugins fixes nothing. Your server needs a new PHP version, that is 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Versions 8.1 and older are no longer supported. For those there are only source-level fixes, which Patchstack itself calls a minimal, last-resort measure.

What to do today. In WordPress, open Tools, Site Health, Info, Server and see which PHP version you run. Ask your host whether the fix is in place. If you are on 8.1 or older, take a full backup before any upgrade, because old themes and plugins often break on newer PHP. After the update, change your passwords and check for admin accounts you do not recognise.

The deeper question is why a brochure site or a small shop needs PHP running behind it at all. Every WordPress site is a program that executes on every visit, with a database, plugins and a server that must be updated constantly. When PHP has a flaw, your site is at risk even if you did nothing wrong.

The sites I design do not use WordPress or PHP. Pages are built in advance and served from a global network, so there is no PHP server to attack. A flaw like the one in October simply does not apply to them. They also open almost instantly on a phone, and for e-shops the admin is a simple panel built around how you actually work.

If you have a WordPress site and want to know where you stand, start with the WordPress Check package. I review your PHP version, security, speed and SEO, and tell you plainly whether an upgrade is enough or whether it is time to move to a modern site without WordPress, keeping your Google rankings.