Signs a WordPress website may have been compromised: a checklist

As of October 21, 2026, we found no confirmed case of a WordPress website being broken into through the two security bugs fixed that day, so treat this checklist as a precaution. Most of the signs are things you or your office manager can check from the WordPress dashboard and your phone: users, pages, or plugins nobody on your team added, a website that sends visitors somewhere else, and warnings from the company you pay to keep your website online. If you see one, write down what you saw and when, then contact that company.

What happened on October 21?

The PHP project released fixes for two critical bugs in PHP, the software WordPress runs on, behind the scenes. PHP says the bugs "can allow unauthenticated remote code execution" (php.net). In plain words, someone on the internet could run their own code on the server, the computer your website lives on, without logging in. Researchers have shown the attack working against WordPress, Drupal, and Joomla sites (Huntress, citing Wiz research).

Cloudflare says it has seen attack traffic aimed at these bugs (Cloudflare). CISA, the US cybersecurity agency, said in its October 21 alert that it "has not observed exploitation of these vulnerabilities as of the time of publication" (CISA). That can change, so check our WordPress advisory page for what we've found since.

Why look for signs if nothing has been confirmed?

A fix protects your website from the day it's installed. It can't tell you whether anyone got in before that. The UK's National Cyber Security Centre (NCSC) tells organizations that can't update right away to "assess the system for any evidence of compromise" and "look for backdoors installed by an attacker" (NCSC).

What can you check yourself?

The table draws on WordPress.org's list of "indicators of compromise" (WordPress.org). None of it involves touching the server.

One sign doesn't prove a break-in, and it doesn't prove these bugs were the way in. WordPress.org notes that your hosting company "might also be able to confirm if a hack is an actual hack or a loss of service." In general, most WordPress security bugs turn up in plugins: Patchstack counted 11,334 new WordPress vulnerabilities in 2025, and 91% of them were in plugins (Patchstack).

What should your hosting company or developer check?

Some signs live on the server itself, which isn't a place for you to go poking around. CISA tells the people who run servers to watch for "PHP worker processes launching shells or downloading tools" (CISA), and hunting for backdoors and unfamiliar files is the same kind of job. Ask your hosting company or developer to check, and to tell you in writing what they looked at.

What should you do if you see a sign?

1. Write it down. WordPress.org calls documentation "the first actionable step": what you're seeing, when you noticed it (with the time zone), and anything that changed recently, such as a new plugin. Take screenshots.

2. Contact your hosting company, by support ticket if they have one, so you have a record. WordPress.org points out that when several websites share one server, a problem can reach beyond yours.

3. Ask about the fix in the same message. The note below covers both.

4. Change your passwords. WordPress.org advises changing every way in, including the WordPress admin and your hosting account, and scanning the computer you log in from.

5. If you can't judge it yourself, get professional incident response help, as the NCSC advises.

6. Skip any plugin or pasted code that claims to fix this. Patchstack advises against unofficial "fix" plugins and copied snippets (Patchstack), and WordPress.org says no WordPress update is required or planned for these bugs (WordPress.org). The fix is a PHP update on the server.

The CVE numbers in the note are the official IDs for these bugs, so your hosting company knows exactly what you're asking about.

Subject: Possible problem on [yourdomain.com]

Hello, on [date, time, and time zone] I noticed [what you saw] on [yourdomain.com]. Please tell me, in writing:
1. What you checked on the site and the server, and what you found.
2. Which PHP version the site runs, and whether it includes the fix for CVE-2026-109618 and CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a vendor backport).
3. Whether I need to do anything myself.
Thank you.
[Your name], [account email or account number]

Who should you call?

If nothing on the list turns up, make sure the fix itself is in. How to check your PHP version walks through it.

Who is The Graphite Lab?

The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. If you decide it's time for a new website, the first draft is ready for your review within 10 business days of payment.