The October 2026 PHP vulnerability, is your WordPress site affected?

What happened

When a visitor opens a page of your WordPress site, PHP prepares that page on the server, before sending it to their browser. PHP runs about three sites in four among those whose technology is known, from WordPress to Joomla, Drupal or PrestaShop.

Researchers discovered two vulnerabilities in PHP that let a malicious person make the server run their own instructions. In practice, they can take control of the site, change its content or retrieve its data, without needing a username or a password.

The details were meant to stay confidential until the fix was released, but they circulated a day early. The first attack attempts were therefore seen very quickly, which makes the update urgent.

The fix exists. What matters is making sure it is installed on your site's server.

The sites affected

Every site running on PHP is affected, and therefore every WordPress site. For once, updating your plugins and your theme is not enough. The flaw is in PHP itself, and it can be triggered before WordPress even starts.

So WordPress is not at fault. It remains a solid and safe choice, followed by a dedicated security team and updated very regularly. The flaw is in the language that runs it, and it affects every site built with PHP in the same way, whatever its content management system.

Sites built on platforms such as Wix, Squarespace or Shopify do not depend on your own PHP installation, the platform manages its own servers. Static sites, made only of HTML pages, are not affected either.

Finding your site's PHP version

In WordPress, the PHP version is a few clicks away:

• Open the Tools menu, then Site Health.
• Choose the Info tab.
• Expand the Server section, the PHP version is shown in the list.

You can also find it in your host's customer area, often in the hosting settings. Here is what it tells you:

Version	What you see	What you can do
8.2 to 8.5	A version still maintained by the PHP team.	Check with your host that the fix is installed. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
8.1 and earlier	A version that no longer receives official updates.	Ask your host whether they apply the fix themselves, and plan the move to a recent version.

Some hosts apply the fix without changing the version number shown. If your version looks older than those in the table, asking your host is still the best way to know for sure.

What to ask your host

The fix is installed on the server, so your host takes care of it. A message to their support is enough to be reassured, with these three questions:

• Is the fix for the PHP vulnerabilities of 21 October 2026 installed on my hosting?
• Which PHP version does my site use?
• Have you noticed any unusual activity on my hosting in the last few days?

If your site is managed by an agency or a freelancer, you can ask them these questions. They know your hosting and already know what to check.

If your site uses an older version

Versions 8.1 and earlier no longer receive updates from the PHP team. Some hosts still apply the fix, but it is the right moment to move to a recent version.

This move takes a little preparation. An older theme or plugin may not work with a recent version of PHP. So you start with a full backup, update WordPress, the theme and the plugins, then change the PHP version and check every page of the site. With a site that is looked after regularly, it generally takes less than an hour.

Going further, headless WordPress

If you are preparing to build or migrate a large site and the budget allows it, the headless WordPress architecture is worth a moment of your time. Your teams keep the WordPress administration and their habits, and the public site is developed separately in another technology, with its own advantages.

WordPress can then live in a protected network, reserved for your teams, and your visitors never go through it. Faced with a vulnerability like this one, the update is still necessary, but it can be done without urgency. This architecture also brings speed and great design freedom, in exchange for more complex development and two systems to maintain.

A site that is looked after goes through these alerts calmly

Vulnerabilities are discovered regularly, in PHP as in all software. What makes the difference is how quickly the fix reaches your site. A site that is followed, with regular updates, backups and monitoring, receives the fix within hours of its announcement, without you having to think about it.

This is what I offer with the hosting and maintenance of your sites. I take care of the hosting, the updates, the backups and the monitoring, so that you can focus on your business.

Your questions

Has my site been hacked?

In the vast majority of cases, no. A few signs can alert you, such as an administrator account you do not recognise, pages that redirect to another site or a Google warning in the search results. At the slightest doubt, contact your host and change the passwords of your site and your hosting.

Should I leave WordPress?

No. Every content management system built with PHP is affected in the same way, and the PHP fix is enough.

Should I update my WordPress plugins?

It is always a good habit, but it does not fix this vulnerability. It is in PHP, on the server, and only updating PHP fixes it.

What are the official references of these vulnerabilities?

They are numbered CVE-2026-109618 and CVE-2026-109619. You can quote them to your host so they know exactly what you are talking about.

My site is hosted on Wix or Shopify, do I need to do anything?

No. These platforms manage their own servers and updates.

When I create your WordPress site, you can entrust me with its hosting and maintenance. Security fixes like this one are then included, and installed as soon as they are released, without you having to think about it. Discover web design and the hosting option.