The October PHP security flaw: what it means for your website

On 21 October 2026, the team behind PHP released emergency security updates. Two flaws, logged as CVE-2026-109618 and CVE-2026-109619, allowed an attacker to run their own code on a server without logging in first. The advisory did not hedge about it.

There are no complete mitigations, updating is the only safe choice.

PHP is not a name most business owners have any reason to know. It is the language a great many websites are built on, and every WordPress site in the world runs on it. If your site is a WordPress site, PHP is the plumbing underneath the floor, and for a few days in October that plumbing had a hole in it.

What actually happened

Fixed versions went out the same day: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Two days later a second advisory followed, about a related issue and a setting worth turning off until the next routine release. Hosts who were paying attention updated within hours. Hosts who were not, did not.

The uncomfortable part is who was responsible for acting, because it was not you. Updating the version of PHP a site runs on is a job for whoever provides your hosting, or whoever built the site and still looks after it. If that is a company you last heard from two years ago, nobody made that decision on your behalf.

This is not WordPress’s fault, which is cold comfort

It is worth being fair about this. The flaw was in PHP, not in WordPress, and no WordPress update fixes it. Plenty of WordPress sites sat on well-run hosting, were patched quietly within hours, and their owners never knew anything had happened.

But the exposure is the point. A WordPress site runs code on a server every time somebody opens a page, because that is how the page gets built. You get a great deal in return: a familiar editor, a plugin for almost anything, thousands of themes. You also get a website whose safety depends on a chain of other people keeping a lot of separate parts current. The language, the database, the theme, and every plugin anybody has ever installed and forgotten.

It is common, when we are asked to look at a site, to find plugins nobody can account for. Installed years ago for a feature that is no longer used, still switched on, still part of the site.

Five things worth doing this week

• Ask your host, in writing, which version of PHP your site runs and whether it was updated after 21 October.
• Ask who is actually responsible for applying updates like this one: you, your host, or an agency.
• If the answer is PHP 8.1 or older, your site is on a version that no longer gets standard updates at all. PHP 8.2 stops on 31 December 2026.
• Delete plugins you do not use, rather than only switching them off.
• Make sure you have a backup, and that somebody has tried restoring it.

None of that needs us. If you do nothing else after reading this, send the first two questions to your host today and keep the reply.

The longer question

Every website needs looking after. The real question is how much of it is yours to worry about, and how much there is to cover.

There is another way to build a site. Rather than assembling every page on a server at the moment somebody asks for it, the pages are built in advance and handed over as finished files. There is no PHP waiting to be patched, no database sitting behind the page, no plugin folder for anyone to go looking through. When something like October lands, there is nothing to do, because the part with the hole in it was never part of the site.

That is not magic and it is not a promise that nothing can ever go wrong. Anything connected to the internet needs attention. But how much attention, and how many other people you are relying on to pay it, is a decision made on the day the site is built rather than on the day something breaks.

We wrote a longer piece on why we moved away from WordPress, and why you might, which covers the day to day of it: the speed, the editing, and what happens when you want to change something.

If you would rather somebody looked

If you are not sure what your site runs on, or who is supposed to be updating it, send us the address and we will tell you what we find. No charge, and no obligation to do anything with the answer.

If it turns out your site is in good hands, that is a perfectly good answer and you can get on with your day. If it is not, you will at least know where you stand, and we can talk about what moving it would involve.