On Wednesday, October 21, Wiz Research uncovered multiple critical vulnerabilities in PHP, an open-source scripting language that powers around 70% of all the world, including WordPress. Exploited sites could allow attackers to take control of the site, steal sensitive data, and make changes to the site, all without a password. Unfortunately, because this is an issue with PHP itself, every site using PHP was vulnerable — and, as it turns out, had been for the past 14 years, as the vulnerability existed for years before it was ever discovered. If you own a WordPress website, what do you need to do?
The issue
The vulnerabilities, officially known as CVE-2026-109618 and CVE-2026-109619, affected every version of PHP dating back to version 5.4, which was released in March 2012. Because of the sheer size of the PHP code library, no one had discovered an issue despite its longstanding existence. The vulnerability was discovered in August using AI to search the code library for vulnerabilities, and since then, PHP’s maintainers had been working with Wiz and others to build a fix. According to multiple published reports, Dan Lorenc, the CEO of a security company called Chainguard, heard rumors of a vulnerability and used AI on his own to try to discover it. Using the prompt, “Find bad vulnerabilities in PHP,” Lorenc was able to uncover the issue. To make matters worse, a research team accidentally published a video of the exploit by mistake, forcing PHP to act quickly. On Wednesday, Lorenc said his company’s decoy servers caught IP addresses from China and Russia going after the flaw and people were already getting attacked, so Chainguard released a PHP fix six hours before anyone else, violating an agreed-upon coordinated disclosure among people aware of the issue. In the PHP Foundation’s own words, “Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.”
To make things simple, the process worked well until the last two days, but the end of the process was a gigantic mess. Agentic AI has its benefits —we’ve written before about how you can use AI to help you write website copy and how WordPress 7.0 added AI features — but AI also means software vulnerabilities will be discovered much more quickly for the foreseeable future. And obviously, if the wrong person finds them first or if only one party violates a coordinated embargo, things get messy.
The fix
As we’ve mentioned, WordPress is built in part with PHP, so any WordPress site is affected when a PHP vulnerability is discovered. The good news is your hosting company may have immediately fixed your website for you — but it is extremely important for you to verify this yourself to be sure.
Which versions of PHP are now safe to use?
Every version of PHP since 5.4 was affected by the PHP2Shell vulnerability. PHP 5.4 reached its end of life in September 2015, so unless you were already running an extremely outdated website (which is a security concern for many other reasons!) your site needs to be updated. The most important thing to know is PHP is only actively supporting PHP 8.1 and above at this time. Any version of PHP 8.1 or below is no longer safe to use, so be sure your website is using PHP 8.2 or above. The PHP foundation is working to patch every version of PHP to ensure the vulnerability cannot affect anyone, but your hosting provider may or may not provide these legacy PHP version updates.
Second, be sure your hosting provider has updated your PHP version to the latest release.
- PHP 8.5: All releases prior to 8.5.12 are affected.
- PHP 8.4: All releases prior to 8.4.27 are affected.
- PHP 8.3: All releases prior to 8.3.36 are affected.
- PHP 8.2: All releases prior to 8.2.35 are affected. PHP 8.2 releases official end-of-life at the end of 2026, so it’s a good idea to go ahead and upgrade to PHP 8.3 or newer anyway.
Hopefully, your hosting provider has already communicated with you directly about the issue and their fix. Many hosting providers sent an email as soon as the patch was released letting customers know their site was updated. If you have not received any official communication from your hosting provider, check to ensure you’re using one of the above PHP versions. PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are all safe to use, and all 4 of these versions were released on October 21, 2026.
Remember that updating PHP is a process you complete through your hosting provider’s cPanel or similar system, not through WordPress itself. If you need help figuring out how to upgrade your PHP, our article on using PHP with WordPress includes direct links to how to update your site with several major hosting companies.
