Is Your Website Affected by the PHP Vulnerability?

If your website runs on WordPress, Drupal, Joomla or Magento, update PHP today. That one step closes the two flaws that took government websites offline on October 21, 2026.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, let an attacker run code on a server without a password. Security firm Wiz, one of the teams that found them, called them among the most severe ever found in PHP. Agencies including CISA, the UK's NCSC and CERT-EU urged site owners to patch or go offline until they could.

The good news: PHP released fixed versions the same day. If you act now, this is a maintenance task, not a disaster. Below is how to tell whether you're affected, what to do in the next hour, and what this means for your site long term.

Am I affected?

You're likely affected if your site runs on PHP, and roughly 70% of websites do. Not every PHP site is exploitable, since it depends on how the server is set up, but every one should be updated.

Your site almost certainly runs on PHP if:

It's built on WordPress, Drupal, Joomla, Magento or WooCommerce
Your login page ends in /wp-admin or /wp-login.php
Your hosting plan is shared hosting with cPanel or a similar control panel
Your page addresses end in .php

You're probably not affected if your site is hosted on a website builder like Squarespace, Wix or Shopify (the platform handles its own servers), or if it's built with a JavaScript framework such as Next.js and hosted on a platform like Vercel. If you aren't sure, ask whoever built or hosts your site one question: "Does our site run on PHP, and has it been updated?"

What to do today

The only real fix is updating PHP. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026. Work through this list in order:

Find your PHP version. In WordPress, go to Tools > Site Health > Info > Server. In cPanel, look for "Select PHP Version" or "MultiPHP Manager."
Contact your host. Many managed hosts are patching servers automatically. Ask them to confirm in writing that your server is on a patched version.
Upgrade if you're on an old branch. PHP 8.1 and older no longer receive security fixes. Move to a supported version, and test your site afterward, since old plugins and themes can break.
Update WordPress, plugins and themes. This doesn't fix the PHP flaw, but it closes other doors while attackers are actively scanning.
Take a fresh backup and store it off the server.
Change passwords and API keys if your site was unpatched and online after the news broke. These flaws can expose stored credentials, including database passwords.
Watch for signs of compromise: new admin users, unfamiliar files, redirects to strange sites, or warnings from Google Search Console.

If you can't patch right away, the official guidance from agencies like CERT-EU is to take the site offline until you can. A few hours of downtime is far cheaper than a breach.

Don't want to deal with this yourself? Send us your website address and we'll check it for free. We'll tell you what your site runs on, whether it's been patched, and what (if anything) you need to do. No sales pitch, just a straight answer. Request a free site check.

Why this keeps happening

The deeper issue isn't PHP itself. It's how much code your site runs on a public server every time someone visits.

A traditional WordPress site builds each page on demand. A visitor requests a page, the server runs PHP, queries the database, and assembles the result. That means your server, your database and every plugin you've installed are exposed to the internet around the clock. When a flaw like this one appears, every one of those sites shares it at once.

A modern setup flips this around. Pages are built ahead of time and served as finished files from a global network. Content is managed in a separate, hosted dashboard, so your database isn't sitting on a server you maintain. There are fewer moving parts facing the public, and the infrastructure is patched by the hosting platform rather than by you.

To be clear: no website is unhackable. Modern JavaScript frameworks have had serious security flaws of their own, and they need updates too. The difference is a smaller attack surface, no plugin pile, and far fewer emergencies landing on your desk.

Should you move off WordPress?

Patch first. But once the dust settles, ask yourself a bigger question: do you want to keep being responsible for a server at all?

Every WordPress site owner is now one bad plugin or missed update away from the next emergency. If you have a dedicated developer watching your site, that may be fine. Most small and mid-sized businesses don't, and this week is how they find out.

A move is worth considering if:

Nobody clearly owns updates on your site, or you only found out about this from the news
You're running a stack of plugins you don't fully understand
Your site is slow and it's hurting your search rankings or leads
You were already planning a redesign in the next year

	Traditional WordPress	Modern headless site
Server code on every visit	Yes, PHP plus database	Mostly pre-built pages
Who patches the server	You, your host or your developer	The hosting platform
Plugins	Many, from many vendors	Few or none
Speed	Depends on plugins and hosting	Fast by default
Editing	Familiar WordPress dashboard	Separate visual dashboard
Upfront cost	Lower	Higher, custom build

How a migration works without losing your rankings

A well-run migration keeps your search traffic intact. The biggest risk isn't the new technology; it's broken links and lost pages. Here's the process we follow:

Inventory everything. List every page, blog post, image and form, and export your top pages from Google Search Console so nothing that earns traffic gets dropped.
Move content into a headless CMS. Your team gets a clean dashboard for editing text and images, separate from the live site.
Rebuild the front end. The site is custom-built on a modern framework, keeping the content and page structure that already ranks.
Map every old URL. Each old address gets a 301 redirect to its new home, so Google and anyone with an old link lands in the right place.
Launch, then monitor. Submit the new sitemap, watch Search Console for errors, and fix any missed redirects in the first few weeks.
Retire the old server. Once traffic is confirmed on the new site, the old PHP server is shut down so it can't be exploited later.

Why businesses switch to Hungry Ram

Hungry Ram is a web design and development studio based in Orange County. We build custom websites for real estate developers, property management companies and professional service firms, and we've never built on WordPress. Here's what that means for you:

No more security fire drills. No plugins to update, no PHP server to patch, no midnight emails from your host. The infrastructure is maintained for you.
You still edit everything yourself. Your team updates text, images, listings and blog posts in a simple visual dashboard. No developer needed for day-to-day changes.
A site built around your business, not a template. Custom design and clean code, with pages built to load fast and turn visitors into leads.
Your rankings come with you. Every migration includes a full URL inventory and redirect map, so the search traffic you've earned isn't lost in the move.
One team, start to finish. Strategy, design, development and ongoing care, so you're never stuck chasing three vendors when something breaks.

Start with a free site check. We'll confirm whether your current site is safe today, and if a move makes sense, we'll show you what a faster, lower-maintenance site would look like for your business. Book a free site check.

Is Your Website Affected by the October 2026 PHP Vulnerability? What to Do Now