Insights · 10 chapters
PHP security vulnerability in October 2026: what WordPress site owners should do now
On 21 October 2026 the PHP team released an emergency update. Practically every WordPress site is affected. Here is what you should do now and when switching is worth it.
Overview
Your reading path
Jump directly to the chapter you need right now.
Introduction
On 21 October 2026 the PHP team released an emergency update against two critical security vulnerabilities. According to reports so far, both allow attackers to run their own code on the server without logging in.
PHP is the programming language that WordPress, WooCommerce, Joomla and many other systems run on. If your website is built with WordPress, this very likely affects you.
In this guide you will learn what exactly happened, what you should do today and why the websites we build are not affected by this vulnerability.
Chapter 01
What happened?
The PHP team closed two vulnerabilities that security providers such as Patchstack and several trade publications rate as critical. Each scores 9.2 out of 10 points. This is what is called remote code execution: an attacker can run commands on your server over the internet without having to log in.
According to first reports from hosting providers and security firms, automated scans are already running that specifically look for unpatched websites. With flaws like these, often only hours pass between publication and the first attacks.
According to the announcement, the vulnerabilities are fixed in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older PHP versions that no longer receive updates remain open.
Chapter 02
Am I affected?
Any website whose server runs PHP in a vulnerable version is affected. That mainly means:
- WordPress websites, including those with page builders such as Elementor or Divi
- Online shops with WooCommerce, Shopware or Magento
- Websites with Joomla, Drupal, TYPO3 or Contao
- custom-built applications based on PHP, for example with Laravel
Chapter 03
What it depends on for you
Whether your site is protected is not decided by WordPress but by your server. Only once your hosting provider has updated PHP is the vulnerability closed. Do not assume this, ask.
Chapter 04
What you should do right now
You can take these steps today, even without an agency:
- Ask your host: Get written confirmation that your server has been updated to one of the patched PHP versions.
- Check your PHP version: In the WordPress dashboard under Tools and Site Health you can see which version is running.
- Update WordPress, themes and plugins: Attackers like to combine several vulnerabilities.
- Back up: Download a current backup and store it outside the server.
- Check user accounts: Unknown administrators are a warning sign. If in doubt, change all passwords.
- Watch for anomalies: Unfamiliar redirects, spam pages on Google or a browser warning point to an infection.
Chapter 05
Why WordPress is affected so often
WordPress is not badly programmed. The problem is the principle: with every page request the server rebuilds the page, using PHP, a database and often dozens of plugins from different vendors. Each of these components is a possible door.
Then there is its reach. Because so many websites run on WordPress, it pays off for attackers to exploit vulnerabilities automatically and at scale. As early as July 2026 the German BSI warned about the vulnerabilities known as „wp2shell“, which according to security firms were exploited on a massive scale.
And finally maintenance: many company websites were built once and hardly maintained afterwards. These are exactly the sites that fall first when a new vulnerability appears.
Chapter 06
How we build websites: without WordPress and without PHP
The websites we at MINDWEBMEDIA build and maintain today do not run on WordPress. We develop them individually with Next.js, a modern framework based on JavaScript. PHP is not involved. That is why they are not affected by this vulnerability.
The difference lies in the architecture:
- No third-party plugins: Whatever the site can do is part of its own code and is reviewed with it.
- No public login: There is no admin page where attackers can try out passwords.
- Pre-built pages: Most content is generated at publication and delivered via a global network instead of being rebuilt with every request.
- Central updates: We roll out security updates for all client sites together.
Prefer to have it done for you?Let’s assess your next step with clarity.
In 30 minutes, we review your objective, current situation and priorities. Afterwards, you will know which next step makes sense and whether we are a good fit.
- Assessment of your current situation
- Priorities and open questions organised
- A recommendation for a sensible next step
Chapter 07
To be honest
There is no website without any risk. Modern frameworks have had critical vulnerabilities too. The difference is how large the attack surface is and who reliably takes care of updates.
Chapter 08
Is it worth switching now?
Not every WordPress site needs to be replaced immediately. If it is maintained, up to date and runs with a reliable hosting provider, working through the steps above is enough.
Switching is worth it above all if several points apply:
- The site has not been fundamentally revised for years.
- Nobody reliably takes care of updates.
- Many plugins are installed for simple functions.
- The site loads slowly and hardly generates enquiries.
Chapter 09
How a switch works
Our website relaunch checklist shows how a relaunch works without losing rankings. You can find out how we build websites under web design.
Chapter 10
Sources
This article is based on Patchstack's security warning about the PHP vulnerability, reporting by trade publications such as IT-Administrator and Windows-FAQ from 21 October 2026, and the cyber security warning by the German BSI on the WordPress vulnerabilities from July 2026. We will update the article as soon as new information is available.
In short
The key points at a glance
The PHP flaw of October 2026 is serious but manageable: ask your host, check the PHP version, install updates, back up. If you do this today, you are on the safe side.
If you want to get rid of your WordPress site for good and switch to a fast, low-maintenance website without PHP, we are happy to look at your current site and tell you honestly whether a switch is worth it.
FAQ