Critical PHP Security Update for WordPress Sites

A newly disclosed, high-severity security issue in PHP was discovered yesterday. PHP is the programming language that powers WordPress, and this issue affects the majority of WordPress sites currently online.

What’s the Issue?

The vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), are remote code execution flaws in PHP itself. They are rated 9.2 out of 10 on the CVSS scale. Because the problem is in PHP (not in WordPress or a plugin), an attacker could potentially run their own code on your server without logging in.

Is Your Site Affected?

Most WordPress sites are affected if they are running PHP 5.4 or newer. Sites on the currently supported PHP branches (8.2, 8.3, 8.4, and 8.5) will receive an official patch. Sites on PHP 8.1 or older will not receive an official fix from the PHP project.

The official patches are being released today. Once available, they need to be applied at the server/hosting level.

How This Could Affect You

• An attacker could gain control of your website
• Site data or customer information could be accessed
• Your site could be used to host malware or spam
• Downtime or damage to your site’s reputation

We Can Handle This For You

If you would like us to take care of this update for your WordPress site, we can do so as soon as the patched PHP version is available from your host.

Once the patch is released, we will:

1. Backup your website
2. Log in and apply the PHP update (or coordinate with your host if they manage it)
3. Confirm your site is running the fixed PHP version
4. Verify the site is working normally afterward

If you’d like us to handle this for you, contact us directly with your site details and access information. We’ll prioritize these updates as soon as the patch is available.

Don’t wait on this one. These types of issues are actively targeted once details become public.