Loading articles…
Field notes for building a business that can move without you.
We write from the intersection of operating systems, software, sales, marketing, and leadership—for owners building a more capable company.
News
If your website runs on WordPress, this week's PHP security flaw is your problem too
Two critical flaws in PHP, the language WordPress runs on, let attackers take over a website's server without logging in. Here's what we patched at Measurable Genius, and the four things to check on your own site this week.
- Author
Alexander Ford- Published
- Reading time
- 7 min read
Contents
In brief
- On October 21, 2026, the team behind PHP, the programming language that WordPress runs on, released urgent fixes for two critical flaws. An attacker can use them to take over a website's server without a password.
- Details leaked a day early, and security firms report attacks have already started. Updating PHP is the only complete fix.
- We've patched everything we run that uses PHP: the platform that hosts our software, and the server that hosts our older websites. Telos and Sapience don't use PHP at all.
- If you have a WordPress site, you probably don't manage PHP yourself, but someone does. This article shows you how to check your version in about ten minutes and what to ask your host.
What happened
Most websites have two layers. There's the part you see and edit, like your WordPress pages, theme and plugins. Underneath it is the software on the server that actually runs it. For WordPress, that's a programming language called PHP. You never log into it, but every page on your site goes through it.
On October 21, the PHP team released fixes for two flaws they rate 9.2 out of 10 for severity. In plain terms: someone on the internet can send a specially crafted request to a website and run their own code on its server, without logging in.[1] Attackers scan the internet automatically, so a small business's site is found as easily as a big one's. The PHP team says every installation that serves web pages is affected, in every common setup. Their advice is blunt: "All PHP users are strongly encouraged to update immediately," and "there are no complete mitigations, updating is the only safe choice."[1]
Three things make this one worse than the usual security notice:
- It leaked before the fix was ready. The flaw identifiers circulated on October 20, and the PHP team moved its release up a day as a result.[2]
- Attacks have already begun. Cloudflare reports "early attacks emerging," and the security firm watchTowr reports exploitation attempts against its monitoring network.[2][3]
- WordPress is a named target. Researchers confirmed attacks that work without a login against specific versions of popular PHP applications, including WordPress, Drupal, Joomla and Magento.[2]
If someone takes over the server your website runs on, they can change your site, steal your customers' information, send spam in your name, or use your server to attack others. You often wouldn't notice until a customer, Google or your host tells you.
You'll see this called "php2shell" or by its official names, CVE-2026-109618 and CVE-2026-109619. A CVE is just a public ID number for a security flaw, so everyone can talk about the same problem.
What we did at Measurable Genius
Here's what we checked and changed, in plain terms.
1. The platform that runs our software
Our products, Telos and Sapience, are not written in PHP. But the platform we use to deploy and run them, called Coolify, is itself built with PHP. We upgraded it.
2. The server that hosts our older websites
We still run one web server, managed with a control panel called Plesk, for 14 websites and subdomains, many of them older Measurable Genius sites. Every one of them was running PHP 8.3.35, which is affected.
On October 21, we used Plesk's own updater to install the patched version. All 14 sites now run PHP 8.3.36, the fixed release. We also updated the other PHP versions installed on that server, so nothing unpatched is left sitting there unused. We kept every site on the same PHP branch so nothing broke from the upgrade itself.
Then we checked our work. We confirmed the new version was installed, that every site was assigned to it, and that the server was actually running the patched code. We loaded every site in a browser, and they loaded their pages, login screens or redirects.
3. Everything else
No other Measurable Genius service uses PHP. Telos, Sapience and our internal systems are built on different technology and are not affected by this flaw.
What you should do
Many of you have WordPress websites, some of which we built together. Here's the short version: you need to find out what PHP version your site runs on, and make sure it's one of the fixed versions. Updating WordPress, your theme or your plugins does not fix this. The fix happens one layer down, on the server.
Step 1: Figure out if this applies to you
- WordPress, WooCommerce, Joomla, Drupal or Magento: yes, your site runs on PHP. Keep going.
- Shopify, Squarespace, Wix or Webflow: these platforms manage their own servers, so there's nothing for you to update. It's still worth a glance at their status or security page this week.
- Not sure? Ask whoever built your site, or look at your hosting bill to see who your host is.
Step 2: Check your PHP version
If you can log into your WordPress dashboard, go to Tools → Site Health → Info, and open the Server section. You'll see a line for the PHP version.
You're safe from this flaw if it shows one of these, or anything newer in the same line:
- 8.5.12 or later
- 8.4.27 or later
- 8.3.36 or later
- 8.2.35 or later
If your site is on PHP 8.1 or older, there is no official fix. Those versions are past their end of life, which means the PHP team no longer patches them.[2] Some hosts are adding their own patches, but the real answer is to move up to a supported version.
Step 3: Talk to whoever runs your hosting
How you fix it depends on your hosting:
- Managed WordPress hosting (companies that handle the server for you): they're very likely patching this already. Confirm it with them in writing.
- Shared hosting with a control panel like cPanel or Plesk: your host updates PHP itself, but you may need to choose the version for your site in the control panel. Ask them.
- Your own server, or one a freelancer set up: someone needs to install the update and restart PHP. Make sure they know about it today.
You can copy and send this:
Hi, I'm checking on the critical PHP security flaws released October 21, 2026 (CVE-2026-109618 and CVE-2026-109619). Can you confirm my site, [your website address], is running a patched PHP version (8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer), and that PHP was restarted after the update? If my site is on PHP 8.1 or older, what's the plan to move it to a supported version?
Step 4: Tidy up afterwards
Once your host confirms the fix:
- Change your WordPress admin passwords, and your hosting account password, in case anything happened before the patch.
- Make sure you have a recent backup you could restore from, and know who to call if your site ever starts acting strangely.
- If you use Cloudflare, its firewall has added rules for this flaw. That helps, but it's a stopgap, not a fix.[2]
Why we're telling you this
Nobody starts a business to manage servers. But your website is often the first thing a customer sees, and it carries their trust. When something like this happens, the people who keep your site running should tell you clearly what they did and what you need to do. That's the standard we hold ourselves to, and it's the standard you should expect from anyone who touches your business's technology.
If we built your website and you're not sure who hosts it now, reply to the email that brought you here and we'll help you find out.
[1] PHP Group, security releases and advisory for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, October 21, 2026. php.net
[2] Tenable, "php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities." tenable.com
[3] watchTowr, "PHP remote code execution (php2shell)." watchtowr.com
Plesk customers can also read Plesk's advisory: Vulnerability CVE-2026-109618 and CVE-2026-109619.
