Should you take your WordPress website offline over the PHP bugs?

If a hosting company keeps your website online, taking it offline usually isn't the first step. The NSA's advice to go offline applies "if an immediate update is not feasible," and WordPress.org aims its version at owners who run their own server on an old version of PHP, the software WordPress runs on, behind the scenes. Start by getting a fix date in writing from your hosting company, because that answer tells you whether the offline advice applies to you.

What exactly did the NSA and WordPress.org say?

On October 21, 2026, the day PHP released fixes for two critical security bugs (php.net), the NSA put out an advisory, "NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities." It says the bugs "could allow attackers to take control of affected web servers without prior access or authentication." (The server is the computer your website lives on.) It also says:

WordPress.org's offline advice, posted the same day, is narrower:

CISA, the US cybersecurity agency, goes a step further: organizations "that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated" (CISA).

Each of these comes with a condition, and none tells every WordPress owner to take their website down.

Who is the offline advice really for?

As of October 21, 2026, several hosting companies said on their status pages that they had temporary protection in place while the fix rolled out, and our WordPress advisory page lists the ones we found. Re-check with yours, since those pages change by the hour. Temporary protection, such as a firewall that screens traffic before it reaches your website, buys time but isn't the fix. PHP says: "There are no complete mitigations, updating is the only safe choice" (php.net).

What would going offline cost a shop in heating season?

We won't put a dollar figure on it, since we don't know your numbers. Here's the reasoning instead.

For a heating and air shop, late October is when the phones start ringing. A homeowner whose furnace won't light searches for help, finds your business, and lands on your website for the phone number or the booking form. If the website is down, the easiest move for them is the next result. Overnight form requests never arrive, and every truck wrap, postcard, and ad with your web address on it points to nothing. A burst pipe or a dead panel works the same way.

Your own records hold the real number: count the calls and form requests that came through the website last October.

On the other side is the NSA's warning that the bugs "could allow attackers to take control of affected web servers without prior access or authentication." For a shop, the website's server holds your pages, your logins, and your form submissions. NIST's National Vulnerability Database rates both bugs 9.8 out of 10 on the CVSS 3.1 scale (NVD). Offline is the fallback for when the fix can't happen, which is why the fix date is the first thing to chase.

What should you do instead, and in what order?

1. Find out who runs your server (here's how).

2. Check your PHP version in WordPress under Tools, Site Health, Info, Server (WordPress.org). Some hosting companies install the fix without changing that number (Wordfence), so ask anyway.

3. Ask your hosting company for a fix date in writing, with the note below. If the reply says "mitigations in place," that means temporary protection, so ask for the date of the real fix.

4. Have a full backup taken, files and database, before anything changes, as GoDaddy's own notice recommends (GoDaddy).

5. If you're on PHP 8.1 or older, ask your hosting company to move your website to 8.3 or newer after the backup, which is what WordPress recommends (WordPress.org). Here's how to plan that move.

6. If there's no fix and no date, ask your hosting company or developer to take the website offline until it's fixed, and let them do it so it comes back cleanly. Don't change server settings yourself.

7. Once the fix is confirmed, look for signs anything happened before it.

The CVE numbers in this note are the official IDs for the two bugs, so your hosting company knows exactly which fix you mean.

Subject: Fix date for [yourdomain.com]: CVE-2026-109618 and CVE-2026-109619

Hello, my site [yourdomain.com] runs on your hosting. Please tell me, in writing:
1. Which PHP version my site uses now, and whether it includes the fix for CVE-2026-109618 and CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a vendor backport).
2. If not, the date it will, and what protects my site until then.
3. Whether you would advise taking my site offline until the fix is in.
Thank you.
[Your name], [account email or account number]

Who is The Graphite Lab?

The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. If you decide it's time for a new website, the first draft is ready for your review within 10 business days of payment.