Security advisory
Liveupdated CentralTwo critical bugs in PHP were fixed on October 21. Check your site, then send your host the message below.
Newest first, in Central time. Each update is timed to when the news broke or when we checked.
Latest
Liquid Web, a hosting company, says its engineers are deploying patched versions of PHP, the software WordPress runs on, across its hosting and will email customers. It tells customers who aren't patched yet to run a package update from their control panel. On Liquid Web? Ask them to confirm the fix in writing.
Source: Liquid Web status page
The NSA replaced its short first release with a fuller advisory at the same address. It says the bugs "are flaws in PHP itself, not in the hosted application or its configuration," which is why updating WordPress or plugins won't fix them. It still says to take a system offline if an immediate update isn't feasible. Ask your host for the fix in writing.
Source: NSA advisory, October 21, 2026
Cloudways, a hosting company, says it has applied security patches for every customer application on its Autonomous plans and is still rolling them out on its Flexible plans. On Cloudways? Check which plan you have and ask for the fix in writing.
Source: Cloudways status page
Neither CVE-2026-109618 nor CVE-2026-109619 is in CISA's Known Exploited Vulnerabilities catalog. NIST's National Vulnerability Database rates both 9.8 out of 10 on the CVSS 3.1 scale. If your host hasn't confirmed the fix, ask them today.
Security company Huntress says researchers at Wiz published details showing the attack working against WordPress, Drupal and Joomla sites. Huntress also says it had not seen attacks on its customers' systems as of 3:30 pm Central. With the details public, get your hosting company's answer today.
Source: Huntress, citing Wiz research
GoDaddy says it has patched every PHP version on its Managed Hosting for WordPress plans. For its regular Web Hosting plans, GoDaddy says it has protections in place while its vendor supplies patched versions. On GoDaddy? Check which plan you're on in your account.
Source: GoDaddy
Hostinger's status page says it's rolling out patched PHP across its managed hosting plans and customers don't need to do anything. At 2:12 pm it said its Agency Hosting servers were done and the rest were in progress. On Hostinger? Check the status page before you assume your plan is finished.
Source: Hostinger status page
PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 this morning. NIST's National Vulnerability Database published both bugs and rated each 9.8 out of 10 (critical, CVSS 3.1). PHP 8.1 and older get no fix from the PHP project.
If your website uses Cloudflare, Cloudflare says its firewall has protected it from these PHP bugs by default since 10:02 pm Central last night. That buys time. It isn't the fix: PHP, the software your WordPress site runs on, still has to be updated by whoever runs your website.
Source: Cloudflare blog
Checked against the sources October 21, 2026, 8:45 pm Central. Anything newer is under Live updates.
“If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”
The PHP project released fixes for two critical bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (php.net).
The same day, the NSA advised organizations to prioritize the patches. Its advisory says the bugs “could allow attackers to take control of affected web servers without prior access or authentication” and are “flaws in PHP itself, not in the hosted application or its configuration” (NSA). For a shop’s website, that server holds the pages, the logins and the form submissions.
CISA urged organizations to patch immediately and said it had not observed exploitation as of its alert (CISA). Cloudflare reports attack traffic aimed at these bugs (Cloudflare).
WordPress.org says no WordPress update is needed or planned. The fix is a PHP update on the server (WordPress.org), which is why the first message below goes to whoever hosts your site.
No login needed
PHP says the bugs "can allow unauthenticated remote code execution." In plain English, someone on the internet could run their own code on your web server without logging in.
9.8 out of 10
The NIST National Vulnerability Database rates both bugs critical on the CVSS 3.1 scale. PHP rates them 9.2 on the newer CVSS 4.0 scale.
NIST National Vulnerability Database, PHP security release, October 21, 2026
4 in 10 websites
That's roughly how many run on WordPress, and WordPress runs on PHP. Researchers have shown the attack working against WordPress, Drupal and Joomla sites.
36.4%
of WordPress sites that report a PHP version run 8.1 or older, which the PHP project no longer fixes. Some hosts add their own fixes, so this isn't a count of exposed sites.
From The Graphite Lab
The websites we build for trades shops don't run PHP or WordPress, so these two bugs have nothing to attach to. There are no plugins to keep updated and no login page for anyone to guess passwords on.
It takes about a minute in the WordPress dashboard.
Log in to WordPress and open Tools, then Site Health.
Click the Info tab, then open Server.
Write down the PHP version. Your host's control panel often shows it too, under "PHP" or "Select PHP Version".
Some hosts patch PHP without changing the version number, so the number alone can’t tell you you’re safe. Get your host to confirm in writing.
Sources: php.net, WordPress requirements
Copy it, fill in the brackets and send it today. Ask for the answer in writing.
You pay a company for hosting (GoDaddy, SiteGround, Bluehost and so on). Send it as a support ticket if they have one.
Subject: PHP security fix for CVE-2026-109618 and CVE-2026-109619
Hello, my site [yourdomain.com] runs on your hosting. Please tell me, in writing: 1. Which PHP version my site uses now, and whether it includes the fix for CVE-2026-109618 and CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a vendor backport). 2. If it is not fixed yet, when it will be. 3. Whether I need to change anything myself, such as moving to a newer PHP version. Thank you. [Your name], [account email or account number]
A company built your site or manages it for a monthly fee.
Subject: Is [yourdomain.com] running the October 21 PHP fix?
Hi [Name], PHP released fixes on October 21 for two critical bugs (CVE-2026-109618 and CVE-2026-109619). WordPress.org says no WordPress update is needed, so the fix has to happen on the server. Please answer in writing by [day and time]: 1. Who hosts [yourdomain.com], and who is responsible for keeping PHP patched there? 2. Which PHP version is the site on now, and does it include the fix (8.5.12, 8.4.27, 8.3.36, 8.2.35, or a backport from the host)? 3. If it is on PHP 8.1 or older, when can you move it to 8.3 or newer, after a backup and a test? 4. Have you checked for signs the site was touched before the fix, such as new admin users, unfamiliar files, or redirects? Thank you. [Your name], [phone]
A friend, a relative or a freelancer built the site and may still have the login.
Subject: Quick PHP question about [yourdomain.com]
Hi [Name], A quick one about [yourdomain.com]. PHP shipped fixes on October 21 for two critical bugs (CVE-2026-109618 and CVE-2026-109619). WordPress.org says the fix is a PHP update on the server, not a WordPress update. Can you tell me: 1. Where the site is hosted, and who has the hosting login? 2. Which PHP version it runs? (In WordPress: Tools, Site Health, Info, Server.) 3. Whether the host has installed the fix, and can you get that confirmed in writing? 4. If it is on PHP 8.1 or older, can we move it to 8.3 or newer after a backup? Please reply by [day]. I would rather not try a plugin or a pasted snippet for this. Thank you, [Your name]
From The Graphite Lab
The first draft is ready for your review within 10 business days of payment. Our websites don't run PHP or WordPress, your domain stays registered in your name, and your content is yours.
As of October 21, 2026, 8:45 pm Central, we found no confirmed WordPress compromise from these bugs, so treat this list as a precaution. Not sure? Ask your host or a security professional.
Ask for a date in writing. If you run your own server and can’t update, the NSA’s advice is to take the system offline until it’s fixed. WordPress.org says owners on PHP older than 8.2 who run their own server should consider the same.
From The Graphite Lab
Everything above is for any WordPress owner, whether or not you ever work with us. This part is about us. The websites we build for trades shops don’t run PHP or WordPress, so these two bugs have nothing to attach to, and there are no plugins to keep updated. The first draft of a new site is ready for your review within 10 business days of payment.
See our websitesWe use cookies to see how the site gets used and to follow up with shops that visit. Accept to also allow session recordings, with anything you type hidden. Privacy Policy
Analytics cookies and session recordings show us how the site gets used. Marketing cookies help us follow up with shops that visit. None of it loads unless you say yes. Privacy Policy
