On October 21, 2026, the PHP team shipped an urgent update for two critical PHP vulnerabilities. The notice that spread online cited a severity score of 9.2 out of 10 and a risk that can allow remote code execution: someone running instructions on a server without logging in.
That does not mean WordPress is broken, or that every site is already compromised. It means a large share of business websites run on PHP, and the people who manage those servers need to apply the patch, confirm the site still works, and check which version they are on.
The Problem, Without the Jargon
Think of WordPress as the application that runs your site, and PHP as the language that makes it work on the server. A serious flaw in PHP can leave the site exposed even when WordPress itself is current.
WordPress can be fully updated and still sit on a vulnerable PHP version. The two flaws, CVE-2026-109618 and CVE-2026-109619, are in how PHP handles memory and internal errors. Under certain conditions, a person with no login could use them to run code on the server. This is not a design or layout problem. It sits in the layer that processes every visit.
PHP published fixed versions for the branches it still supports: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer receive security updates from the PHP project, though some hosts may ship their own fixes for older installs. PHP 8.2 itself reaches end of life on December 31, 2026, so a patched 8.2 server still needs an upgrade plan before the year ends.
The patch does not come from the Update WordPress button. It is applied on the server or in your host’s control panel. WordPress.org explains the scope of the alert and where to check the PHP version. The official PHP advisory lists the corrected versions. The U.S. Cybersecurity and Infrastructure Security Agency also urged organizations to patch immediately and, at the time of its notice, had not seen these flaws exploited in the wild.
What This Can Do to a Business Site
The first consequence is operational. A host may need to restart services, isolate servers, or put a site in maintenance while the patch goes on. For a shop in Atlanta, that can mean the website, the contact form, the booking calendar, or checkout stops working for a stretch.
The second is the attack risk. If a server stays on a vulnerable version and someone exploits it, they could run code, change files, create accounts, redirect visitors, install a backdoor, or reach information the site processes. A vulnerability that allows those actions does not mean they have already happened on every site. Leaving the server unpatched is still an unnecessary bet. PHP’s own advisory says updating is the only complete fix.
The third shows up after the update. WordPress rarely runs alone. It usually sits with a theme, several plugins, WooCommerce, payment integrations, forms, and custom code. Changing the PHP version can surface incompatibilities that were invisible day to day, and then someone has to test, fix, and publish again.
An alert like this is not solved by clicking update and walking away. You also need to know who manages the server, when the last backup was taken, whether a restore has been tested, and what backup channel you have if the site goes offline.
WordPress Is Not Automatically Unsafe
WordPress remains a valid tool for many projects. It lets a team edit content without calling a developer for every change, and the plugin ecosystem is huge. The trouble starts when a site is installed once and nobody owns the full update chain after that.
Several pieces on a WordPress site can fall behind:
- The server: the PHP version, the operating system, the database, and the hosting software.
- WordPress core: the application that manages pages, posts, users, and settings.
- Plugins and the theme: third-party pieces that add features and can also introduce bugs or incompatibilities.
- Integrations: payments, forms, email, analytics, and any outside service connected to the site.
Updating one piece and forgetting the others creates a false sense of safety. At a small company, this work often sits with one person who has other jobs and only thinks about the website when an alert appears.
What to Check for This PHP Vulnerability
There is no need to panic or switch platforms today. There is a need to get concrete answers from whoever administers the site:
- What version of PHP is the server running?
- Has the host already applied one of the fixed versions, or an equivalent vendor patch?
- Is there a recent backup, and has a restore been tested?
- Were the theme, plugins, WooCommerce, and integrations checked after the change?
- Who responds if the site goes down or shows a sign of intrusion?
In WordPress, the PHP version is under Tools > Site Health > Info > Server. If the site is on a version older than PHP 8.2 and the host does not offer a supported fix, treat that as a priority. WordPress.org notes that people who manage their own hosting should consider taking that server offline until it can be updated. No WordPress core update is required or planned for these particular flaws.
The Platform Is Only Part of the Question
An alert like this makes visible something that usually stays hidden: a website is not only what appears on screen. It is also a server, a language, a database, a set of dependencies, credentials, and maintenance tasks.
Owning a site still matters, as we covered in The Future of Websites. The new question is how much infrastructure you need to meet the goal of the business.
If the site needs a full editorial system and someone on the team will maintain it, WordPress can remain a sound choice. If you are about to build a new site, it is worth knowing the alternatives we use for new work: Astro for fast, mostly static marketing sites, and Medusa when the project is an online store. A site that does not run PHP on every visit does not carry this class of server risk. That is how new Bits Kingdom sites are built.
The next time you review the site, do not stop at whether it looks right. Ask what has to stay updated for it to keep working, and how many of those tasks you actually need. That answer says more about the right platform than any trend.
