Critical PHP Flaw Puts WordPress Sites at Risk: What Business Owners Should Do This Week

If your business runs a WordPress site, updating WordPress is not enough this week. A critical flaw affects PHP: the software engine underneath WordPress and many other websites. The fix needs to be applied to the PHP runtime on the web server.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can allow an unauthenticated attacker to run code on an affected server or read sensitive information from its memory. The PHP project released security updates on October 21. Business owners should ask their web host or IT provider to verify the version running their site and confirm the fix is in place.

What happened, and why business owners should care

PHP is a programming language used by an estimated 70% of websites. It powers popular platforms including WordPress, Drupal and Joomla. The newly disclosed flaws are in PHP’s core engine, not in WordPress itself.

In plain terms, the bugs affect how PHP handles memory when a request fails or runs out of memory. Under certain conditions, an attacker can send a specially crafted request that causes PHP to mishandle that memory. The possible results include:

• Remote code execution: An attacker can run their own code on the server without logging in.
• Memory disclosure: Information held temporarily in server memory (such as passwords, authentication tokens, API keys or certificates) could be exposed.

The vulnerabilities are rated up to CVSS 9.2. Researchers say the underlying bugs had been present for more than a decade, and that PHP versions dating back to 5.4 are affected by at least one of them.

That does not mean every website running PHP has been compromised. It does mean organizations should identify affected systems and apply the appropriate fix promptly. Because PHP is used by many different applications, the issue extends beyond WordPress.

Why an updated WordPress site can still be exposed

WordPress.org says these vulnerabilities affect any server hosting a PHP application, and that no WordPress update is required or planned to address them. The repair is at the PHP level.

That distinction matters: updating WordPress core, themes and plugins does not update the PHP runtime on the server. Even a basic PHP page can be exposed if it runs on an affected version.

A website often serves as a business’s front door. It may collect customer inquiries, accept appointment requests, process orders or receive other sensitive information. If a server is compromised, an attacker could potentially access information submitted through the site, alter its content or use it as a starting point for further investigation of connected systems.

The AI angle: a change in how quickly complex flaws can be exploited

Researchers at Wiz, working with OpenAI and Calif, reported developing working exploit chains for these flaws with help from advanced AI models. They demonstrated unauthenticated code execution against current WordPress, Drupal and Joomla installations.

The point for business owners is not that AI makes every vulnerability immediately exploitable. It is that AI tools may reduce the time and specialist effort needed to investigate difficult flaws and build practical attacks. Those tools can also help defenders find vulnerabilities and validate fixes. For organizations, the sensible response is to shorten the time between a security advisory and a verified patch, not to assume that complexity will keep a flaw out of reach.

What to do this week

Work through these steps with your website host, web developer or IT provider.

1. Find out which PHP version your site uses. In WordPress, go to Tools → Site Health → Info → Server and check the PHP version. Your hosting control panel may show it as well. If you cannot find it, ask your host to confirm the version serving the live site, not just a version available in a control panel.

2. If the site runs PHP 8.1 or older, treat it as urgent. These versions no longer receive security updates from the PHP project. Plan an upgrade to a supported PHP version, 8.2 or newer, and ask your host to confirm the move will not break your site. Some operating-system or hosting vendors may provide backported security fixes for older versions; do not assume they have done so. Ask for confirmation that the specific PHP2Shell fixes are applied.

3. If it runs PHP 8.2 or newer, confirm the October 21 security release is installed. The PHP project published fixed releases for supported branches: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Your host may deliver updates on its own schedule or package PHP through its platform. Ask which fixed version is running and whether the web server or PHP workers were restarted so the updated runtime is actually in use.

4. Ask what temporary protection is in place. Some providers have added web application firewall (WAF) rules to help block known exploit attempts. Ask your host what protections are active for your site and when they were enabled. A WAF is an extra layer, not a replacement for updating PHP.

5. If you manage your own server and cannot patch promptly, consider taking the PHP-based system offline. The UK National Cyber Security Centre advises organizations that cannot immediately remediate to consider taking the system offline until it is fully mitigated. CISA also recommends prioritizing internet-facing systems and taking unpatched PHP-based systems offline when they cannot be updated immediately.

6. Review activity and confirm your recovery options. After patching, ask your provider to check for unusual traffic and server behavior. Researchers note possible signals such as unusual multipart or file-upload requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID cookies, and unexplained PHP worker restarts. These clues do not prove a compromise, and normal logs may not show what happened clearly. Make sure you have a recent backup and that your provider can restore it.

Make sure someone owns the follow-through

Many business owners do not know what PHP version their website runs. That is understandable: it is usually managed behind the scenes by a hosting provider or web developer. But the host may not contact you about every urgent security advisory, and a control panel showing a newer version does not necessarily confirm that the live site is using it.

This is where a proactive IT relationship helps. Someone should be responsible for tracking relevant advisories, identifying which systems could be affected, coordinating updates and confirming that fixes have taken effect. After remediation, that person should also help assess whether unusual activity needs further investigation.

At B&R Computers, our approach to cyber risk is to identify exposure, understand the potential business impact, mitigate it and continue monitoring. Website hosting is one part of the broader environment we can review with you; this article is not a claim that any particular site or host is affected.

For the latest authoritative guidance, review the PHP Foundation’s security release, the WordPress notice and CISA’s alert. You can also explore B&R’s cybersecurity resources and join the General Cyber Briefing for ongoing security insights.

If you are unsure who manages your website’s PHP, or whether the fix has been applied, schedule a Business Review or Strategy Session with B&R Computers. We can help you review your exposure, clarify next steps and make sure the right people are responsible for follow-through.