What the NSA's PHP advisory means for your WordPress website

On October 21, 2026, the NSA advised organizations to prioritize the patches for two critical bugs in PHP, the software WordPress runs on behind the scenes, and to take the system offline if it can't update right away. If your website runs on WordPress, the question for you is whether your hosting company (the company you pay to keep your website online, such as GoDaddy, Bluehost, or SiteGround) has installed the fix. Updating WordPress won't do it.

What did the NSA say?

The NSA first posted a short release on October 21, then replaced it that evening with a fuller advisory at the same address: "NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities." It calls the two bugs "PHP2Shell." These are its key lines, in its own words:

“

"It is essential for all to prioritize incorporating vendor patches that may be explicitly tied to the PHP2Shell issues."

"If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated."

"'PHP2Shell' could allow attackers to take control of affected web servers without prior access or authentication."

"These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration."

NSA advisory, October 21, 2026

In plain words: get the update in, and if that can't happen right away, take the website offline until it's fixed. Someone could take over the computer your website lives on without logging in, and because the flaw is in PHP, not WordPress, a WordPress update won't fix it. The advisory doesn't say which versions are fixed. That comes from the people who make PHP. We track any further NSA guidance, and anything else that changes, on our WordPress advisory page.

What are the two bugs?

Every time someone opens a page on your website, PHP builds that page on your server, the computer your website lives on. PHP's own advisory says these two bugs "can allow unauthenticated remote code execution" (php.net). That means someone on the internet could run their own code on that computer without logging in.

The PHP project released fixed versions on October 21. Versions 8.1 and older no longer get fixes from the PHP project at all (php.net).

Both bugs are rated critical. As of October 21, 2026, NIST's National Vulnerability Database scores each one 9.8 out of 10 on the CVSS 3.1 scale (first bug, second bug), and PHP scores them 9.2 on the newer CVSS 4.0 scale (PHP security advisory).

Why does it matter for your WordPress website?

WordPress runs on PHP, and researchers have shown the attack working against WordPress sites (Huntress, citing Wiz research). Because the bugs are in PHP and not in WordPress, a website can be affected even when WordPress and its plugins are up to date. As of October 21, 2026, WordPress runs about 4 in 10 websites (W3Techs).

The NSA's phrase "take control of affected web servers" has a plain meaning for a shop. Your website's server holds its pages, its logins, the form submissions customers send you, and every file your website is built from.

Is anyone attacking websites with these bugs?

The sources disagree, and both statements are on the record. Cloudflare, a company that filters traffic for websites, says it has seen attack traffic aimed at these bugs (Cloudflare). CISA, the federal cybersecurity agency, said it had not observed exploitation as of its October 21 alert (CISA). As of October 21, 2026, neither bug was on CISA's list of bugs known to be used in attacks.

What did WordPress.org say?

WordPress.org posted "Critical PHP Security Release" the same day. It says the bugs are not specific to WordPress, that "No WordPress update is required or planned for these issues," and that owners should still check with their hosting company. For owners who run their own server on a PHP version older than 8.2, it says to consider taking the server offline while they prepare to update (WordPress.org). We explain why updating WordPress won't fix this in a separate post.

What should you do today?

1. Find out who keeps your website's PHP up to date. If you pay a hosting company, that's its job. If you or a developer rent a server of your own, the job is yours or your developer's (Wordfence).

2. Check your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open Server (WordPress.org). If it reads 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or higher on the same series, the official fix is in. Our step-by-step guide to the PHP version explains every other number.

3. Ask your hosting company, in writing, whether your website has the fix. Some fix PHP without changing the version number your site shows, so the number can't settle it alone (Wordfence). Here's the message to send your hosting company.

4. Make sure there's a full backup of your website before anyone changes its PHP version (GoDaddy).

5. Skip any plugin or code snippet that claims to fix this. Patchstack, a WordPress security company, advises against both (Patchstack).

What if the fix can't go in right away?

Then the NSA's fallback applies: take the system offline until it can be fully mitigated. CISA says the same for systems that can't update immediately or still run PHP 8.1 or earlier (CISA).

If you pay a hosting company, it installs the fix, and your job is to get a date from them. If you run your own server, the decision is yours. For a heating and air shop in late October, offline means no website the week the phones start ringing, which is the best reason to get that date now.

Who is The Graphite Lab?

The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. If you're weighing a new site, the first draft is ready for your review within 10 business days of payment.