Is Your WordPress Site Patched? The Emergency Update to Ask About Today
The 60-Second CMO, by Juli Anne Patty, Fractional CMO
In brief: If your website runs on WordPress or anything else built on PHP, it needs an emergency security update this week. On October 21, 2026, PHP released fixes for two critical flaws that let attackers take over a web server without logging in. Attacks have already been reported. Ask your web host or agency today whether your site is patched.
What happened?
PHP is the programming language behind WordPress, Drupal, Joomla, Magento and many other website platforms. Security researchers found two critical flaws in it, nicknamed "PHP2Shell." They let an attacker run their own code on your web server without a password. PHP released emergency patches on October 21, and Cloudflare reported early attacks before the fixes were even out.
Why should a founder care?
A hacked website is a marketing problem, not just an IT problem. It can:
Lose its Google rankings, or get flagged with a warning in search results.
Spread malware to the prospects who visit it.
Damage trust right when buyers are checking you out.
Is my website affected?
Probably, if it runs on WordPress or another PHP-based platform and is hosted on a server someone has to maintain. Sites on fully hosted builders such as Squarespace or Wix are maintained by the platform, so this isn't your job to fix. If you're not sure what your site runs on, ask whoever built it.
What should I do today?
Send one email to your web host or agency: "Has our site's server been updated for this week's critical PHP security patches (CVE-2026-109618 and CVE-2026-109619)? Please confirm the PHP version we're running."
Check the answer. Patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer. If your site runs PHP 8.1 or older, it no longer gets official updates, so ask about upgrading.
Don't install a random "fix" plugin. The real fix happens on the server, through your host.
Ask about your staging and old sites too. Forgotten test sites and old landing pages can be exposed as well.
Frequently asked questions
Does updating WordPress fix this?
No. The flaws are in PHP, the software running underneath WordPress. Your host or developer has to update PHP on the server.
Is my Squarespace or Wix site at risk?
These platforms manage their own servers, so there's nothing for you to patch. This update is for sites that run on their own or a hosting company's PHP servers.
What if my host hasn't patched yet?
Ask when they will. If your site handles sensitive data and the patch is delayed, ask whether it should go into maintenance mode until it's fixed.
Sources
BleepingComputer, PHP ships emergency patches for critical PHP2Shell flaws, October 21, 2026.
Patchstack, Major security alert: PHP vulnerable to critical RCE, attacks ongoing.
CISA, Critical Vulnerabilities in PHP Require Immediate Patching, October 21, 2026.
Get every tip in one free weekly email. Sign up for The 60-Second CMO Weekly at www.juliannepatty.com.