PHP cyber-security update: The National Security Agency warning for WordPress

Your website should help customers choose your business. An urgent warning about the software behind it creates a different job: finding out whether it is safe to keep online. The latest PHP cyber-security update, backed by warnings from the National Security Agency and the FBI Cyber Division, makes that a priority for businesses running WordPress. Both agencies advise updating affected systems and taking them offline if an immediate update is not feasible until they can be fully mitigated. Read the NSA advisory and the FBI Cyber Division's warning.

Start with your hosting provider today. Ask whether your site's PHP installation has the fixes for both vulnerabilities and what action is needed if it has not been updated.

Information checked on October 23, 2026. This article covers the October 21 PHP security releases; follow the linked advisories for subsequent changes.

What the National Security Agency and FBI are warning about

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. The PHP project's October 21 advisory confirms that they can allow unauthenticated remote code execution. In plain language, an attacker may be able to run code on an affected server without signing in.

The two flaws involve how PHP handles memory and internal request state. The maintainers describe out-of-memory corruption and stale global state, respectively. Their advisories rate both vulnerabilities 9.2 out of 10 under CVSS v4.0. That is a severity rating, not a prediction of how likely your particular site is to be attacked.

The NSA explains the potential consequences: server takeover, sensitive-data theft, disrupted services, or access further into a network. These are flaws in PHP itself.

Why this matters to your WordPress business website

WordPress runs on PHP. As WordPress's own documentation explains, your hosting company sets the PHP version at the server level. Updating WordPress, a theme, or a plugin is a separate task from updating that runtime.

That distinction matters when your dashboard says everything is current. It does not establish whether your host has applied these PHP fixes. A security plugin is also not evidence that the underlying server is patched: PHP's advisory describes a demonstrated attack against Apache with mod_php that can start before application code runs.

For a service business, the practical concern is straightforward. Your contact form, quote requests, and service information need to be available when prospective customers visit. An emergency server issue puts those business functions in question, even if the pages looked fine yesterday.

Websites taken down: what those headlines mean

News about websites taken down can sound as though every outage is a successful attack. The advisory calls for a precaution as well: taking an affected system offline when it cannot be updated immediately. Temporary isolation can be a protective decision. An offline website alone does not establish that it was compromised.

Likewise, the broad PHP usage figure in the TweakTown headline you may have seen is not a count of hacked websites. Your next decision should be based on your host's patch confirmation and the official guidance.

Your PHP cyber-security update checklist

You do not need to become a server administrator. You do need a clear answer from whoever manages your hosting.

1. Ask which PHP version and package your live site uses. Include other installations attached to your account, such as a staging site or an old subdomain. The UK National Cyber Security Centre recommends inventorying PHP systems, including vendor products that bundle PHP.
2. Get confirmation that both vulnerabilities are fixed. The PHP project released 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on October 21. Ask for a fixed release appropriate to your supported branch, or documented vendor backports. PHP notes that some operating-system and long-term-support vendors supply backported fixes, so a version number alone may not settle the question.
3. Have your developer check compatibility and recovery arrangements. WordPress recommends a backup and checking theme and plugin compatibility when updating PHP. Coordinate this promptly with your host rather than leaving a vulnerable site exposed while a redesign is discussed.
4. Follow the agency guidance if patching cannot happen immediately. Ask your provider about isolating the affected system. PHP says configuration workarounds reduce exposure to specific attack paths but do not make an installation safe; an update is the complete solution.
5. Ask about signs of compromise, not just the update. The FBI advises monitoring for suspicious server activity. If compromise is suspected, it recommends isolation, preserving logs, and reporting to the appropriate FBI field office or IC3. Applying a patch is not proof that an earlier intrusion has been removed.

You can send your host this message:

Please confirm whether the production PHP installation serving our website has fixes for CVE-2026-109618 and CVE-2026-109619. Which PHP package or vendor advisory confirms the fix, when was it applied, and do any staging sites or other PHP services on our account still need attention? If you cannot confirm protection, please explain the immediate isolation plan.

After patching, is your website still earning its keep?

An urgent update is also a useful moment to review the way your website is managed. You may be happy with WordPress and have a host that handles maintenance well. In that case, patching and keeping clear responsibilities may be the right approach.

But if you already struggle with slow mobile pages, a pile of plugins, broken layouts after updates, or uncertainty about who fixes problems, there is a broader business decision to make. How much of your time goes into keeping the website working, and how well does it help people get in touch?

Our view is that a service-business website should make your services clear, load efficiently on a phone, and give visitors an obvious next step. Its maintenance requirements should match the functions you actually need.

A PHP-free website: how our High-Performance service addresses the problem

If your business needs clear service pages and a dependable route to an inquiry, you do not have to keep a WordPress stack to deliver them. Ranking Assist's High-Performance Website Design service gives you a custom, PHP-free Next.js website, with copy shaped around your business and search foundations included from the start.

The specific benefit in this story is removing the affected technology from the replacement site. Your new website does not need a PHP update to address a PHP runtime vulnerability. We also build without a WordPress page-builder plugin stack, and changes can be previewed and checked before customers see them.

That is a practical change in what your website depends on. Any retained WordPress installation, old hosting account, or PHP-powered integration still needs attention and a clear retirement or maintenance plan.

The agreed website build includes:

• Custom design and copy that explain your services and guide customers toward an inquiry.
• Responsive development and image optimization with mobile performance considered throughout the build.
• SEO foundations, including page metadata, structured data, internal links, and a sitemap.
• Migration planning, with existing URLs reviewed and redirects planned where addresses change.
• Forms, agreed tracking, pre-launch checks, and ownership handover.

The build is $5,500 USD for the agreed scope. Hosting and ongoing care are quoted separately. A rebuild needs a plan for your content and functionality; it does not replace emergency patching or incident response.

This is worth discussing if your website mainly presents services, demonstrates your expertise, and generates inquiries. If you depend on WooCommerce, memberships, or specialized WordPress integrations, those requirements need to be assessed before deciding to move.

What if another technology has a vulnerability later?

You should expect the software behind any website to need maintenance. A PHP-free build removes this particular dependency; it does not remove every possible security risk.

With Ranking Assist, you own your website code and content. That gives you options to update or replace affected components, change providers, or plan a wider platform change when it makes business sense. You are not tied to a WordPress page builder to keep developing the site.

The right response to a future vulnerability depends on what is affected. Switching a whole programming language can require substantial redevelopment; a targeted patch or component replacement may be the appropriate fix. We agree on hosting, ongoing care, and maintenance responsibilities separately, so you know who handles those decisions.

Make your next website decision with a clear plan

Get your host's patch confirmation first. Then, if your WordPress site is already creating more work than it should, see what our High-Performance Website service includes.

Want a website that works for your business without depending on PHP? Send Ranking Assist your website address and ask about a High-Performance Website rebuild. Tell us which features you need to keep and what is getting in the way today. We will discuss a PHP-free replacement, the migration requirements, and the agreed scope before the build begins.