October 21, 2026
Updating WordPress Won't Fix the Flaw Under It
Two critical flaws in PHP, the engine under most websites, were patched today with attacks already starting. Updating WordPress alone will not fix this.
Reade Taylor Founder & President
Reviewed by Chris Archer, Sales & Marketing Director The short version
Two critical holes in PHP, the engine under roughly seven out of ten websites, were patched today in an emergency release. An attacker who finds an unpatched server can run their own code on it with no password and no login. Researchers call the pair PHP2Shell (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 out of 10, and exploitation attempts began within hours.
Do these four things today
- Ask your web host two questions, in writing: which PHP version your site runs, and when the October 21 fix lands. Safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Do not stop at the WordPress update button. Updating WordPress, plugins or themes does nothing for this. The fix is on the server, by whoever runs your hosting.
- Find every other place PHP runs in your business: intranet tools, help desks, control panels, firewalls and storage appliances that bundle their own copy. Each one needs the patch and a restart of its web service.
- Get confirmation of the fix itself, not a version number. Some vendors patch without changing the number you see.
Cyber Command clients: nothing to do, call us with questions any hour at (407) 587-0089. Everyone else: the details, and a way out of this cycle, are below.
Not just WordPress
WordPress gets the headlines because it runs most small-business websites, but the flaw is in PHP, not in WordPress. Patchstack notes it reaches every version of WordPress and everything else built on a vulnerable PHP version: Drupal, Joomla, Magento and other online stores, Laravel applications your developer built for you, and the software that quietly runs inside a business. That last group is the one that gets missed.
PHP hides in appliances and software packages that bundle their own copy: the web interface of a firewall or a network storage box, an on-premises help desk or wiki, an HR or intranet tool, a hosting control panel, a monitoring dashboard. None of those show up in a WordPress dashboard. If your IT provider only checked the public website, the check is not finished.
The timing makes it worse. The fix was supposed to arrive Thursday under a coordinated embargo, but details slipped out on October 20 and the PHP team moved the release up a day. Attackers and defenders got the starting gun at the same time. Cloudflare’s CTO says early attacks are already emerging, and some organizations are not waiting to find out: BambooHR took its service offline as a precaution, and several Dutch government sites did the same.
Stuck on something like this right now?
Talk it through with a real US-based engineer, 24/7, no phone trees: (407) 587-0089.
Book a Free Strategy SessionWhy the update button does not help
WordPress, your plugins, your theme, your forms, all of that sits on top of PHP the way your car’s dashboard sits on top of the engine. You can click every update button in your WordPress dashboard today and the vulnerable engine underneath stays exactly as vulnerable as it was. The fix happens at the server level, which means it belongs to whoever runs your hosting, not to whoever edits your website.
Keep updating WordPress and your plugins anyway. That hygiene still matters. It just does not close this hole.
Good hosts are ahead of you. SiteGround, for example, rolled out server-level protections on all its servers before the official release, with no customer action needed. Do not assume your host did the same. Ask.
If your PHP is old, this is the week that stops being a theory
Everything back to versions released more than a decade ago appears to be affected. Versions 8.1 and older no longer get official updates; the PHP team published special one-time fixes for 7.4, 8.0 and 8.1, but anything older has no official fix at all. A PHP core developer put it bluntly: the only real mitigation is patching or upgrading.
One more date for your calendar. PHP 8.2 stops receiving updates on December 31, 2026. If this week’s scramble lands you on 8.2, you have bought ten weeks, not a solution.
Or get your website off PHP for good
Tired of this cycle? We can move your WordPress site to a faster, safer, fully managed platform with no PHP, no database and no plugins to patch.
We did exactly this with our own website in August. Every page and every URL stays where it is, anything that moves gets a permanent redirect, and your titles, descriptions and structured data carry over, so the search rankings you have earned stay in place. The result is a site that loads in a fraction of the time, has no server to break into, and is monitored and maintained by us. You keep editing content the way you do today; we handle everything underneath.
It is not for every site. If you depend on a plugin-heavy storefront or a membership system, we will say so and help you patch and harden what you have instead.
Ask us about moving your site off PHPOr call (407) 587-0089 and ask for a website conversion review.
Whoever does the work, make sure someone owns it
If Cyber Command manages your IT, you do not need to act on this post. Call us with any question about it, any hour, at (407) 587-0089. That is what the agreement is for.
If we do not manage your IT, your own team or your current provider can run the checklist at the top, and any provider worth paying will welcome the questions. What no business should accept this week is silence. If you ask who owns your PHP patching and nobody can answer, that gap is the finding, and it is fixable: our business IT services team handles this kind of patch response as routine work, and our co-managed IT arrangement adds our engineers alongside the staff you already have, designed to make sure updates like this one get owned, applied and verified instead of assumed.
A patch released at 10 a.m. does not protect anyone at 10 p.m. unless somebody did the work in between. Make today the day somebody did.
#CyberSecurity #ManagedIT #WordPress #PHP #SmallBusiness
Get updates like this in your inbox
Plain-English alerts when something like this breaks, and the occasional guide. No sales sequences; unsubscribe with one click.
This article is for general informational purposes only and is not legal, compliance, insurance, or other professional advice. Threats, technologies, and regulations change quickly; confirm current requirements with your own advisors before acting. See our full disclaimer.