WordPress Websites at Risk: Why Updating WordPress Won't Fix It

Is your website built on WordPress? Two critical flaws in PHP, the software that WordPress and many other websites run on, have seen millions of attack attempts, and updating WordPress won't fix them. Councils, governments and Wikipedia's operator took systems offline while they updated. Here is what it means for your business and what to do today.

The short version: WordPress and plugin updates do not fix this. Your hosting company has to fix it on the server. Ask them to confirm it in writing today, and do not rely on the version number alone to tell you whether your site is safe.

Last checked: 1 November 2026. This is a fast-moving story, and everything below comes from the sources listed at the end, so check them for updates.

What has happened

PHP is the software that runs on the server behind a huge number of websites. When someone visits a page, PHP collects the data and builds what they see. On 21 October 2026 the team that maintains it released emergency fixes for two serious flaws, nicknamed php2shell.

Both are rated 9.2 out of 10 for severity. Under the right conditions, an attacker could use them to take control of the server your website runs on, without needing to log in. The BBC reported that the researchers used AI tools to find them, and that the underlying bugs had sat in PHP for about a decade.

Are websites really being attacked?

Attackers are certainly trying. Cloudflare's chief executive said it had seen thousands of attempts in the hours before the announcement, rising to millions afterwards. On 26 October the US cyber security agency CISA added both flaws to its list of vulnerabilities known to be exploited, and one researcher recorded successful attacks on test servers set up to catch them.

The UK government took 32 of its own sites offline as a precaution. So far nobody has published a count of hacked business websites, and CISA has not named any victims. One scan found about 5.1 million internet addresses running PHP, although that does not mean all of them are vulnerable.

Does this affect my website?

If your site runs on WordPress, WooCommerce, Joomla, Drupal, Magento or anything else built with PHP, yes.

If your site is on a hosted builder such as Wix, Squarespace or Shopify, the servers are the provider's responsibility, so look for a statement on their status page. This website is built on Next.js, not PHP, so there is nothing here for me to patch.

Why updating WordPress won't fix it

The flaws are in PHP itself, so installing the latest WordPress and plugin updates does nothing for them. The BBC quotes the ethical hacker Ken Munro saying the fix has to be applied to PHP and cannot be resolved by updating WordPress or its plugins, and Wordfence has said automatic WordPress updates will not install it either. Whoever runs your server has to do it. That is your hosting company, or whoever manages the server for you.

What to do today

1. Check your host's status page or support site. Some hosts have already patched their customers' sites. GoDaddy, for example, says it patched Managed Hosting for WordPress on 21 October and its standard web hosting on 22 October, with no action needed from customers.
2. Find out which PHP version your site uses. In WordPress, go to Tools, then Site Health, then Info, then Server. A version of 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer includes the fix. An older number does not always mean you are unpatched, because many hosts fix the flaw without changing the number. That is why the next step matters.
3. Ask your host or developer to confirm the fix is in. A written yes is worth more than any version number. Copy and paste this: "Please confirm that the PHP security release of 21 October (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's equivalent) has been applied to my site, that PHP has been restarted so the fixed version is running, and what to do if I am on an older version."
4. If you are on PHP 8.1 or older, expect no official fix. Those versions are no longer supported. Ask whether your host provides its own patched version. If it does not, move the site to a supported version after testing it. WordPress recommends PHP 8.3 or newer.
5. Be wary of emails about this. Security researchers quoted by the BBC warned that scammers are likely to use the publicity for phishing, so do not click a link in an email about a PHP update. Go to your host's own site instead.

Signs your site may have been attacked

If your site was running an unpatched version, look for:

• Administrator accounts you do not recognise in WordPress, under Users.
• Files or plugins you did not upload or install.
• Sudden spikes in traffic, slowdowns, or your hosting provider warning about unusual activity.
• Spam pages or odd redirects when you search for your own site on Google.

Make sure you have a recent backup you could restore from. If you are not confident checking your own site for signs of compromise, the NCSC suggests using an NCSC-assured incident response provider.

The bigger problem is older PHP

PHP 8.2 stops receiving security fixes on 31 December 2026, and PHP 8.1 and older already have. Adding up the published WordPress.org figures, about 35% of WordPress sites are on PHP 8.1 or older, and a further 23% are on 8.2. Sites on versions that no longer get official fixes are the ones left most exposed when something like this happens.

That is the real lesson for a small business. Software you do not look after does not stay safe by being left alone, and the AI tools that found these bugs can help attackers as readily as defenders. I wrote about the wider cost of an ageing WordPress site in Is Your WordPress Website Losing Customers?, and about checking a site that was built quickly in Built Your Website With AI? A Security, Legal and SEO Checklist.

Patch, or rethink?

For most WordPress sites, the right answer this week is to get PHP patched and to move off any version that is no longer supported. A rebuild is not a panic reaction to one bulletin.

It is worth asking, though, whether your site needs a server running PHP at all. A brochure site with a contact form often does not, and a simpler set-up has fewer moving parts to keep up to date. If you are weighing it up, my website price guide explains what a rebuild costs, starting from £500 for a basic brochure site, and my web design and development page explains how I work.

Need help securing your website? Get in touch for an honest view on whether to patch, upgrade or rebuild, and I will look at where your site stands.

For your developer or host

The technical detail, if someone is handling this for you.

• The flaws: CVE-2026-109618 and CVE-2026-109619, found by researchers at Wiz and Calif. The UK's National Cyber Security Centre (NCSC) says organisations using any version of PHP are affected. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Patched builds with an older number: Codeable explains that hosting that uses CloudLinux can backport the fix, so a protected site can still show something like 8.5.11. GoDaddy says patched builds on its web hosting keep the previous version number and carry a build date of 21 October 2026 or later. Site Health cannot see that build date, but php -v shows it.
• Your own server: install your Linux distribution's updated PHP packages, or update to one of the fixed versions, then restart PHP and your web server. Back up first.
• If it cannot be fixed quickly: the NCSC's advice is to apply the PHP project's temporary mitigations, which are incomplete, and if those cannot be applied either, to consider taking the system offline until it is fully protected. Cloudflare has also put protective rules in place that are available to all its customers, including those on the free plan. Treat that as a stopgap and not a substitute for updating.
• A separate issue still open: CVE-2026-115560, disclosed on 23 October. As of 1 November, PHP's news page lists no fix and says details will come with its next release. It only affects unusual configurations: sites where session.serialize_handler is set to php_binary or php_serialize and switched to php at runtime before the session starts, with session upload progress enabled. The recommended stopgap is to set session.upload_progress.enabled to 0 in php.ini, restart PHP and test any file upload progress bars. GoDaddy says it had this setting in place on its shared hosting before the announcement.
• Other equipment: Daniel Stewart of the risk firm LRQA told the BBC that PHP is commonly found in the management screens of network equipment such as routers and load balancers, so check any advisories from your suppliers as well.

Sources

• BBC News: What is PHP and why did it spark a global cyber-security scramble? (22 October 2026, updated 23 October)
• NCSC: Critical security issue affecting PHP (published 21 October, updated 23 October)
• The Register: reporting on CISA's listing of the flaws (27 October 2026)
• BleepingComputer: PHP2Shell security flaws now successfully exploited in the wild (26 October 2026)
• Recorded Future: PHP2Shell exploitation, two critical PHP flaws explained (scan figures)
• GoDaddy: Important PHP security update, what website owners need to do (patch dates, version numbers and the second flaw)
• Codeable: PHP security release, what WordPress site owners need to do (checking a backported fix)
• Help Net Security: PHP2Shell, critical PHP vulnerabilities patched (fixed versions and technical detail)
• LBC: UK cyber security warning over critical PHP flaws (Wordfence comment)
• PHP: 2026 news archive (23 October advisory on CVE-2026-115560)
• CloudLinux: CVE-2026-115560 status and mitigation (affected configurations)
• PHP: supported versions and WordPress requirements

This is my own summary of public reporting, and not formal security, legal or professional advice. Check with your hosting provider about your own site. Views are my own and not those of my employer.