Emergency PHP updates have prompted warnings from WordPress and the UK’s National Cyber Security Centre, with website owners urged to check their hosting security.
WordPress website owners are being urged to contact their hosting providers and confirm that urgent PHP security updates have been installed following the disclosure of two critical vulnerabilities.
The PHP project released fixes on 21 October for weaknesses that could allow attackers to run code on a web server without logging in. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were rated critical, with severity scores of 9.2 out of 10 under the CVSS v4.0 system. 2026
The issues have become known as PHP2Shell. Cloudflare said it had observed attack traffic targeting its customers and had deployed protective firewall rules before public disclosure. Its researchers also reported attackers changing their requests in attempts to bypass those protections. Cloudflare Blog
PHP is the programming language that runs WordPress on a website’s server. It processes requests and helps generate the pages visitors see, making its security relevant to businesses, online shops, publishers and other organisations using the platform.
WordPress has published an official notice encouraging website owners to update PHP immediately and check announcements from their hosting companies. It confirmed that these vulnerabilities affect the underlying PHP software and are not specific to WordPress.
For website owners, that distinction determines where the fix must be applied. Updating WordPress through its dashboard does not install the required PHP security patch. WordPress says no separate WordPress update is required or planned for these particular vulnerabilities. WordPress News
The fixed PHP releases announced on 21 October include 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting providers and server administrators should use the appropriate patched release or updated package supplied by their software vendor.
Operators using older PHP branches should check whether their provider supplies a backported security fix and arrange a move to a supported version. The PHP project warns that temporary mitigation measures reduce exposure to particular attack routes but do not provide a complete solution. 2026
WordPress users can find their current PHP version by opening Tools → Site Health → Info → Server in their dashboard. Hosting control panels may also display this information. Owners should ask their hosting provider to confirm that the relevant security fixes are active. WordPress News
The UK’s National Cyber Security Centre has urged organisations to identify PHP installations across their infrastructure, prioritising systems accessible from the internet.
Where updates and temporary protections cannot be applied promptly, the NCSC advises considering taking affected systems offline until they can be secured. It also recommends investigating possible compromise where systems cannot be updated or disabled immediately. National Cyber Security Centre
Sources and references
- WordPress.org — Critical PHP Security Release, 21 October 2026.
- PHP.net — Official security advisory and fixed releases, 21 October 2026.
- UK National Cyber Security Centre — Critical security issue affecting PHP, 21 October 2026.
- Cloudflare — Protections against PHP2Shell vulnerabilities, 21 October 2026.
