Critical PHP Release – What WordPress Site Owners Need To Know

Edit: The fix releases were rolled out on the afternoon of 21st October. Our clients don’t have to do anything as they were patched immediately upon release, but if you’re not a client make sure to confirm with your web host that your site has been patched, and if you are on a PHP version below 8.2 arrange an immediate upgrade.

On Tuesday the 20th October, the PHP security team gave advanced notice on an emergency security release to fix two critical vulnerabilities. The release is scheduled for later today (Wednesday 21st October) at around 3pm.

PHP powers a vast chunk of the web, including every WordPress website. If your website runs on WordPress, this affects you. Here’s what we know, what it means for your site, and what to do next.

What Was Announced

The PHP team has rated both if these vulnerabilities as 9.2 out of 10, so critical, on the CVSS v4.0 scale (Common Vulnerability Scoring System). Its official notice doesn’t describe the flaws or list affected versions yet, but it is believed to be PHP versions 5, 6, 7, and 8. Those details will likely be published along with the fix.

The early warning came after details reportedly leaked ahead of the planned disclosure. Security firm watchTowr says both are remote code execution flaws, meaning an attacker could potentially run their own code on an affected server. Obviously a very bad thing. Researchers are tracking them as CVE-2026-109618 and CVE-2026-109619, and the exploit has been nicknamed PHP2Shell, so you may see it referred to as such.

Why This Matters For WordPress Sites

This isn’t a plugin or theme vulnerability you can fix from you WordPress dashboard. It sits on PHP itself, the language that WordPress runs on, along with much of the internet in general (including Drupal, Magento, Joomla, ExpressionEngine, Craft CMS, TYPO3, Statamic, and many more). This means it has to be patched at the server level.

Remote code executions are among the most serious types of vulnerability, as a successful attack could allow someone to take over a website, inject malware or spam, steal customer data, or use the server to attack others. eCommerce sites, including those running WooCommerce, are a big concern because of the payment and customer data that they handle.

Timing is the other worry here. Security firm Sansec has said it expects mass exploitation attempts to begin as soon as the details are public, so the gap between the fix being available and the fix being applied is where sites are most exposed.

Which PHP Versions Are Impacted

According to watchTowr, every PHP version from PHP 5 onwards may be vulnerable, but this will be confirmed by the PHP team with the patch release.

It looks like only supported versions on the most current version 8 branch will receive an official patch (so 8.2 onwards):

If your site is on PHP 8.1 or earlier, there won’t be an official patch. That makes upgrading to a supported version urgent, not optional. It’s a bigger problem than it sounds, with one estimate putting around 884,000 web facing servers on PHP 8.1 or older. That is a big chunk of the web.

What To Do Now

1. Check your PHP version – In WordPress, go to Tools > Site Health > Info > Server. Your hosting control panel will also show it.
2. Take a full backup – Files and database, stored off the server, before any updates are applied.
3. Use Cloudflare if you can – Cloudflare (which we use for our clients) has deployed firewall rules against the known attack methods, free on all plans, and says it is already seeing early attacks. This buys time but isn’t a fix: you still need to patch.
4. Talk to your host today – On managed or shared hosting, your provider applies PHP patches. Ask when they’ll roll out the fix and confirm your site is included.
5. Apply the patch as soon as it’s out – If you manage your own server, update PHP the moment fixed packages are available from php.net or your OS vendor.
6. Plan an upgrade if you’re on PHP 8.1 or older – Test your theme and plugins on a staging site first, as older code may not be compatible with PHP 8.2+.
7. Watch for unusual activity – New admin users, unfamiliar files, unexpected redirects or a sudden spike in server load can all be signs of compromise.

How We’re Handling It For Our Clients

If Impact Media hosts or maintains your website, you don’t need to do anything. Every client site we manage already sits behind Cloudflare, so it’s covered by Cloudflare’s protective firewall rules right now. Our hosting partner, Cloudways, will apply the official PHP patches as soon as they’re released and has already put temporary protective measures in place.

Not a client, or unsure what PHP version your site runs? Get in touch and we’ll check your site and talk you through the safest route to a supported, patched version.

If you’d like to learn more about our WordPress & WooCommerce Support & Maintenance plans, drop us an email or give James a call.

Our plans provide a holistic solution to your website’s performance, reliability and security, and are inclusive of premium tools and services.