Did Your Web Host Patch Your WordPress Site After October's Security Alert?

Reading Time: 11 minutes

You pay someone to keep your WordPress site updated, or you click “Update” on your plugins yourself, so you probably assume the site is protected. This week, that assumption may be wrong, and you would not see it from your dashboard.

On October 21, 2026, the team behind PHP, the server software your web host runs underneath every WordPress website, released an urgent fix for two critical security flaws that let an attacker run their own code on a server without logging in. CISA’s alert says the pair is known as “php2shell.” On October 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its list of vulnerabilities known to be used in real attacks.

Because these flaws live in the server software and not inside WordPress, clicking “Update” in your WordPress dashboard will not fix them. Think of it like the difference between updating an app on your phone and updating the phone’s operating system. WordPress and your plugins are the apps. PHP is the operating system your web host runs in the background so WordPress can build a page when a customer visits. When that background software needs a security fix, your web host (or whoever manages your server) has to apply it.

Here is what the update means for your business, a quick first check you can run from your own dashboard, and the exact message you can copy and send to your web host today.

First, does this affect your website?

Not every business website runs PHP. Start by checking what your site is built on:

• Your site is on Shopify, Squarespace, Wix or Webflow: These are hosted platforms. The platform company runs and patches its own servers, so there is no PHP version on your account for you to manage.
• Your site is a pre-built (static) site hosted on Cloudflare, like the ones we build: Its public pages are finished files with no PHP running underneath, so there is nothing to patch on those pages. If your team also runs a separate PHP tool, such as a WordPress blog, a forms app or a customer portal, that tool still needs this check.
• Your site runs on WordPress or WooCommerce: Check it. WordPress runs on PHP, so your site is affected unless your host has already installed the fixed version. The check below tells you which. (If your site runs on another PHP system such as Drupal, Joomla, Magento or a custom PHP build, skip to the copy-paste email below and ask your host which PHP version you are on.)

A quick first check inside your WordPress dashboard

You do not need developer access or a hosting login to see which PHP version your WordPress site is using. It is on a screen inside your normal dashboard, per WordPress’s own Site Health documentation:

1. Log in to your WordPress admin dashboard (on a standard install, yourdomain.com/wp-admin).
2. In the left-hand menu, hover over Tools and click Site Health.
3. At the top of the Site Health page, click the Info tab.
4. Scroll down and click the Server section to open it.
5. Find the line labeled PHP version and write down the number you see (for example, 8.3.36 or 8.4.27).

Compare your number against the fixed versions PHP released on October 21:

Reference note for your IT team or web host: PHP’s October 21, 2026 security advisory covers CVE-2026-109618 and CVE-2026-109619, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. In the National Vulnerability Database, PHP’s own score for both is 9.2 out of 10 (CVSS v4.0): see CVE-2026-109618 and CVE-2026-109619. PHP says only the update is a complete fix; setting changes reduce exposure but do not make a server safe. Separately, on October 23, 2026, PHP published an informational advisory for CVE-2026-115560, which the October 21 releases do not fix. It only affects an unusual combination of settings and application code, and PHP suggests session.upload_progress.enabled=0 until its next regular bugfix release. Including all three codes in your email lets your host’s support team confirm both steps at once.

Why WordPress sites fall behind on server updates

If your check turned up an older version, you have plenty of company. According to WordPress.org’s public statistics, as of October 27, 2026, 33.6% of WordPress sites that check in for updates run PHP 8.1 or older (including 15.1% still on PHP 7.4), versions the PHP project no longer updates. Another 23.2% run PHP 8.2, which, per PHP’s supported versions schedule, stops getting security fixes on December 31, 2026. Together, that is more than half of the WordPress sites that check in (56.8%) facing a server upgrade decision by the end of the year. These shares shift daily as sites check in.

In the WordPress sites we review, the pattern is familiar. A business pays to have its website built, launches it, and gets back to serving customers. Over the next few years, someone logs in now and then to add a page or click “Update” on a plugin, but nobody touches the server software, because they worry an upgrade might break an older theme or the contact form.

Automatic WordPress updates only cover part of the picture. Patchstack’s 2026 State of WordPress Security report counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025: 91% in plugins, 9% in themes, and only 6 low-priority issues in WordPress itself (6 out of 11,334 rounds to 0%, which is why the two percentages already add up to 100). WordPress itself is solid software. The upkeep comes from the plugins added on top of it and the server software underneath it, and this month’s alert sits in that second layer, which a plugin update never touches.

Some hosts apply urgent server updates to every account automatically. Others wait for a scheduled update window, or need you or their support team to switch the new version on for your account. Your Site Health screen tells you which one happened.

What to do next, in three steps

Compare your number only with the fixed release for its own line: 8.2 with 8.2.35, 8.3 with 8.3.36, 8.4 with 8.4.27, 8.5 with 8.5.12. If your number is older than the fix for its line, or you are on 8.1 or older, follow these three steps. You do not need to touch server settings yourself.

1. Send this email to your web host or web person

Copy and paste the note below into an email or support ticket to your hosting company or your web developer:

Subject: Server security update check for [yourdomain.com] (October 2026 PHP update)

Hi team,

Could you please check [yourdomain.com] and confirm three things for us?

1. Has our server been updated to the October 21, 2026 PHP security release (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer) that fixes CVE-2026-109618 and CVE-2026-109619, and is that version active on our site now?
2. Have you reviewed PHP’s October 23, 2026 informational advisory for CVE-2026-115560, which suggests setting session.upload_progress.enabled=0 until the next regular PHP bugfix release, and does it apply to our setup?
3. If our site is on PHP 8.1 or older, have you applied a vendor backport fix, and can we test an upgrade to a supported PHP version on a staging copy first so we can confirm our theme, plugins and forms still work?

Thank you,
[Your Name]

2. If your site is on PHP 8.1 or older, test before you switch

Jumping from PHP 7.4 or 8.1 to a current version on a live website can break a layout or an older form if the site uses outdated plugins. Ask your host to test the upgrade on a staging copy (a private practice copy of your website) first, and check three things before it goes live:

• Your homepage and top service or product pages load normally on a phone.
• Your contact or quote form sends a test message that actually arrives. For a contractor that is the quote request; for a dental practice, the appointment form; for a college, the program inquiry form.
• Your checkout or booking calendar completes a test step without errors.

CISA’s alert is blunt here: “Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.” It also notes that a security filter in front of your site, such as Cloudflare’s web application firewall, may provide some protection until the update is done. PHP is just as clear that only the update is a complete fix, so treat a firewall as a stopgap, not the answer.

3. Re-check Site Health to confirm

Once your host replies that the update is done, log back into Tools > Site Health > Info > Server in WordPress and confirm that the PHP version line now shows the fixed release for your line, or a newer one on the same line: 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

When the upkeep itself is the problem

A well-kept WordPress website is still a great tool when your team logs in every week to publish articles, build landing pages and manage content. We build and support WordPress sites, and we still recommend WordPress to clients whose teams use it that way. When you use WordPress that actively, ongoing website maintenance services that cover all four layers (WordPress itself, your theme, your plugins and the server software) are a normal, predictable part of running the site.

Where we see owners get frustrated is with a 10- to 30-page service or lead-generation website that barely changes from month to month, yet still needs year-round plugin and server upkeep to stay secure and load quickly on phones.

For businesses in that camp, our website design team increasingly builds pre-built sites hosted on Cloudflare instead. Cloudflare serves those finished pages from its network in more than 340 cities. Because our builds have no PHP and no plugin stack on the public pages, there is no PHP version to patch there and fewer moving parts to break when a customer clicks your ad or Google listing. The forms, any editing tool and the build itself still need someone to own them, so the upkeep gets smaller rather than disappearing.

If you would rather keep WordPress and hand off the updates, our WordPress development services team handles upgrades like this one, including the staging tests above.

Key takeaways

• Updating WordPress plugins does not update PHP. PHP is the server software your host runs underneath WordPress, and it needs its own updates.
• This one is urgent. PHP calls the October 21 flaws critical, and CISA added both to its list of vulnerabilities used in real attacks on October 26, 2026.
• More than half of WordPress sites that check in for updates face a server upgrade decision by year-end. As of October 27, 2026, 33.6% of those sites ran PHP 8.1 or older and another 23.2% ran PHP 8.2, which loses security support on December 31, 2026 (WordPress.org).
• 91% of the 11,334 WordPress vulnerabilities Patchstack counted for 2025 were in plugins. Only 6 low-priority issues were in WordPress itself (Patchstack, 2026).
• Start with a quick check. Open Tools > Site Health > Info > Server in your dashboard, compare your PHP version to the table above, and send your host the copy-paste note so they can confirm the October 21 fix and the October 23 follow-up.

Questions to answer about your own website

• What PHP version is your site on today, and when did anyone last change it?
• If your host emailed you about this update, who on your team would have seen it?
• Who is responsible for testing your contact form, booking calendar or checkout after a server change?
• How often does your team actually edit the website, and does that match what you pay to keep it running?
• If your site went offline for a day to be patched, what would that cost you in calls, bookings or orders?