On October 21, 2026, php.net released a critical security update for PHP, the language WordPress runs on. It fixes two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. They can allow unauthenticated remote code execution, and some reports call them "PHP2Shell".
We've patched every PHP version on the Wordify platform, from 7.4 to 8.5. You don't need to do anything for your sites to get the fix.
What we did
Added extra protections across the platform, including our web application firewall (WAF), at 10:35 UTC on October 21, before the official fix was out.
Applied the fixes to every PHP version we run during an emergency maintenance window. The rollout started at 14:52 UTC and finished at 16:53 UTC on October 21.
Sites on PHP 8.2, 8.3, 8.4 and 8.5 now run the fixed releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Sites on PHP 7.4, 8.0 and 8.1 have the PHP security team's source patches applied, because those versions no longer get official releases.
This covers every site we host in every region (US, UK, AU and DE), including staging sites and Dev Sites.
Do I need to do anything?
Not for the fix. It's already applied, and you don't need to restart anything, clear caches or update WordPress or plugins for it.
There's one recommendation: if your site runs PHP 7.4, 8.0 or 8.1, move it to PHP 8.2 or newer. Those versions are end of life. They got this patch, but they won't get future security fixes. If your plugins and theme support it, PHP 8.3 or newer gives you the longest support window.
How to check your PHP version and upgrade
Log in to Wordify Console and open your site.
Under Hosting, select PHP. Your current version is shown under PHP Version.
If it's 7.4, 8.0 or 8.1, choose 8.2 or newer and click Save.
Confirm in the dialog. Leave Safe Update on.
With Safe Update on, we check your site before and after the switch. If it starts returning server errors on the new version, we put the previous version back automatically and email you the error WordPress reported. That error usually names the plugin or theme to update before you try again.
To upgrade several sites at once, use the Update PHP Version bulk action on the Sites list. More detail is in Configuring PHP settings.
Common questions
Was my site attacked?
We saw exploit attempts from 08:44 UTC on October 21 using a public proof of concept, followed by wider automated scanning from around 12:00 UTC. Our WAF blocked every attempt we found, and we've seen no sign that any succeeded. If you notice anything unexpected on your site, such as unknown admin users or files you didn't add, contact us and we'll look into it.
Was there downtime?
We patched during an emergency maintenance window and expected very little downtime. If your site had a problem on October 21, let us know and we'll check it.
I'm on PHP 7.4, 8.0 or 8.1. Am I protected?
Yes, against these two vulnerabilities. Those versions are still end of life, so upgrade to 8.2 or newer when you can.
Can you upgrade my PHP version for me?
We don't change PHP versions automatically, because some plugins and themes don't support PHP 8.2 or newer yet. Change it yourself with Safe Update on, as described above, and the check will catch any incompatibility. If you'd like help, our team can look at your site with you.
Do I need to send you my domain to check my site?
No. The fix was applied to every site on the platform. You only need to check your PHP version, using the steps above.
Where can I read more?
Our live blog of the fix, with the full timeline and technical detail
Need help?
Message us from Console or email [email protected]. Our team is available 24/7, with a one-hour response time.