A major incident on PHP, and what it means for your WordPress website

Last checked 11:05 UTC, Wednesday 21 October: the fix is still due at 14:00 UTC, and nothing new changes what you need to do. We will update this post when the fix is out.

What happened

Your WordPress site is written in a programming language called PHP. Every time somebody opens one of your pages, the server that hosts your site runs PHP to put the page together. If the site is WordPress, Drupal, Joomla, Magento or WooCommerce, it runs on PHP.

Yesterday, somebody posted that two serious flaws had been found in PHP itself. Security researchers were meant to keep these quiet until a fix was ready. The post was taken down within hours, but by then it had been copied all over social media. The people who look after PHP have now brought their emergency fix forward. It is due out today, Wednesday 21 October, at 14:00 UTC (16:00 in South Africa, 15:00 in the UK). It may come out sooner.

Why it matters

Most WordPress security news is about a plugin: one add-on, on some sites, with a bad lock. This is different. The flaw is in the engine underneath WordPress, and the engine runs before WordPress or any plugin does. That is why the usual answers do not help here. Security plugins cannot fix it, and nor can updating WordPress.

The flaws are what is called remote code execution. That means somebody on the internet can make your server run instructions of their choosing. In practice, it could hand over the whole server: your site, your database, your customers' details, and whatever else lives on that machine. PHP's own team rates both flaws 9.2 out of 10 for severity.

The fix gets published at 14:00 UTC. Attackers can read a fix as well as anyone, and use it to work out exactly where the hole is. One security company expects mass attacks within fifteen minutes of the release. As of this morning, nobody has reported attacks yet.

Am I affected?

If your website runs WordPress, assume yes until somebody who can see your server tells you otherwise. Exactly which versions of PHP are affected will be published with the fix. Early reports suggest it reaches a long way back.

There is one group to worry about most: sites on an old version of PHP. Only the current versions, 8.2 and newer, are expected to get a fix. Many sites still run 7.4, 8.0 or 8.1 because "it still works". If yours is one of them, there may be no official fix for you at all.

What to do this morning

You do not need to understand any of the technical side. You need to know who looks after your server, and to make sure they are on it today. That might be your hosting company, a web agency, a freelancer, or someone in your own IT team.

Send them something like this:

Hello. PHP is releasing an emergency security fix today at 14:00 UTC for two critical flaws (reported as CVE-2026-109618 and CVE-2026-109619). Could you confirm:

1. which version of PHP our website runs on;
2. that you will apply the fix today, as soon as it is out;
3. if we are on PHP 8.1 or older, what you will do, since an official fix may not come for those versions;
4. once it is done, that you have checked the site for any sign of a break-in.

Thank you.

If you don't know who looks after your server, that is worth finding out today too. Your hosting company's name will be on the invoice you pay for the site.

What you don't need to do

• Don't install a security plugin in a hurry. It sits on top of the problem, not beneath it.
• Don't take the site down unless whoever looks after it advises you to.
• Don't panic about WordPress updates. Keep doing them, but they are not the fix this time.

The bigger question

Once today is over, it is worth asking why a website that mostly shows the same pages to everybody needs a program running on every visit, and why that program has to be watched forever.

Most business websites don't need it. A site saved as plain files has nothing on the server to run on each visit. It just hands over pages it already has. There is no PHP to patch at 14:00 on a Wednesday, and no plugin with a bad lock.

That is what Offramp does. It moves a WordPress site to plain files and a simple editor, and the site looks exactly as it does today. There is no redesign and no rebuild, and your team keeps publishing while we move it. It won't get you off WordPress before 14:00 today, though, and nothing will. Patch first. Then, when you have a moment, ask whether you want to be doing this again next year.