On 21 October, two critical flaws were found in PHP, the software that runs almost every WordPress site. They let a stranger take over the server your site lives on without logging in. Attackers were already trying it, and updating WordPress will not stop them.
What happened, in plain English
A WordPress site is not one thing. It sits on top of a language called PHP, which runs on a server. Think of WordPress as the shopfront and PHP as the building it stands in.
The building has a door nobody knew about. Anyone who finds it can walk in, run their own code on your server, and read what the server remembers. The researchers who documented it say that includes passwords and API keys.
A hacker sends your site a crafted request
No account, no login, no phishing email. Your site is just online.
PHP trips over it
The flaw lets them run their own commands on the server.
They are inside
They can copy customer data, plant malware, redirect your visitors or lock you out.
Is this actually happening?
Yes. Amazon's security team saw the first attempt on 17 October, four days before the fix was published. watchTowr's honeypots recorded real exploitation on 21 October. Cloudflare saw attack traffic hitting its customers, with attackers rewriting their requests to get past its filters. Amazon now describes the flaw as broadly exploited in the wild.
The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A fix existing and a fix being installed on your server are two different things.
Why updating WordPress does not help
This is the part that catches people out. WordPress.org put out a statement the same day: the flaws are "not specific to WordPress", and "no WordPress update is required or planned". You can update WordPress, every plugin and your theme, and your site is just as open.
The fix has to happen on the server. That is your host's job, not yours. You cannot click a button in your dashboard to do it.
The 36% with nobody coming to help
The PHP team only ships fixes for PHP 8.2 and newer. WordPress.org's own numbers show roughly 36% of WordPress sites run something older. About 16% are still on PHP 7.4 alone.
For those sites the fix depends on whether the host decides to patch an old version themselves. WordPress.org's advice to anyone running their own server on a PHP older than 8.2 was to consider taking it offline while they update.
Check your site in two minutes
Do this now
- Log in to WordPress. Go to Tools > Site Health > Info > Server. Write down your PHP version.
- If it says 8.1 or lower, you are in the 36%. Message your host today.
- If it says 8.2 to 8.5, check it is 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer.
- Ask your host one question: "Have you applied the 21 October PHP security fix to my server?" Get the answer in writing.
Some hosts are further ahead than others. Pressable, WP Engine, Pantheon and DreamHost have all said they are patching or blocking attacks. Liquid Web was still finalising its plan on the day we checked, and GoDaddy asked customers to check their own PHP version. Look at your host's status page rather than assuming.
Why this keeps happening to WordPress sites
Not because WordPress is badly built. This flaw is not WordPress's fault at all. It keeps happening because a WordPress site is a pile of parts you or your host have to keep patched: PHP, WordPress itself, the plugins, the theme and the server. Every part is another way in, and every part needs somebody to remember.
| Who patches it? | WordPress | Shopify |
|---|---|---|
| The server and language | Your host, if they get to it | Shopify |
| The platform itself | You, or a developer you pay | Shopify |
| Plugins and add-ons | You, one by one | App developers, inside Shopify's sandbox |
| Server for you to forget about | Yes | You do not have one |
Shopify stores do not run on PHP, so this flaw does not touch them. More to the point, there is no server on a Shopify store for you to forget to patch.
If you want out
Moving a WordPress or WooCommerce store to Shopify is a job we do. Products, customers, order history, redirects so your Google rankings survive, and a theme built for how your customers actually buy. You do not have to do it this week, and you should not panic-migrate on a Thursday.
What you should do this week is check your PHP version and get your host's answer in writing. If you decide the pile of parts is not worth it any more, that is the conversation we are here for.
Sources
- Critical PHP Security Release, WordPress.org
- PHP Security Release on 21 October 2026: What WordPress Site Owners Need to Do, Codeable
- PHP CVE-2026-109618 and CVE-2026-109619: early mitigation steps, Mattias Geniar
- Critical PHP Security Release: Your Version Number Won't Tell You If You're Patched, LearnWoo
- PHP security release announcement, php.net