The critical PHP security vulnerabilities discovered in October 2026
On 21 October 2026, two critical security vulnerabilities were found in PHP, the programming language that powers WordPress and millions of other websites around the world.
The vulnerabilities were serious and, as you’d expect, had a lot of tech teams and hosting engineers a bit panicked to say the least. I’d imagine the coffee consumption was higher than average (and probably stress levels too) as everyone looked to address the vulnerabilities as soon as possible.
Good news though: if we look after your site on WP Engine everything is already patched, fixed, and secure. There’s nothing you have to do or worry about.
This is all part of the hosting service Jambi offers as well, so there’s no extra charges or anything like that to worry about.
What WP Engine did to remedy the issues
Quite impressively I think, even before the official security patches were released, WP Engine introduced additional protections at both the network and server level to help prevent the vulnerabilities from being exploited. Once the patches were available they were applied to all the versions of PHP available on WP Engine.
I was receiving updates throughout the process too, and they also posted updates to their status page.
Some more details
There are some lovely nerdy details on the PHP homepage at the moment, but in short, the vulnerabilities, collectively known as PHP2Shell, involved flaws in how PHP manages a web server’s memory. Under certain conditions, attackers could exploit these flaws to run malicious code on a server. This isn’t necessarily WordPress-specific problem, as the the issues were found in PHP, the programming language that WordPress sits on top of, but it did affect WordPress sites as well as other sites that use PHP.
It’s also been a good week for this kind of thing, as on Tuesday 20th October there was a big Google Cloud outage that also affected a lot of websites, including the likes of HSBC, RightMove, and the NHS. The timing is quite a coincidence, but they are separate and unrelated incidents. The Google Cloud outage was caused by an electric power failure at a Google Cloud data centre in London, though Goolge hasn’t yet published a full incident report. It was no doubt another stressy morning for the engineers over there too.
Final thoughts
I totally appreciate that technology failing is inconvinient and stressful – probably better than most actually! So if I can share any further details on these incidents or you’d like to discuss website security in any form, please do let me know any time.
