Part of Esipick, building software since 2013.Security alert: critical PHP flaw. Check your site free esipick.com
Security alert · Updated October 26, 2026

Critical PHP flaw: patch your website now.

Two flaws in PHP itself let an attacker take over a website's server without a password. PHP runs about 70% of websites, according to Wiz, including most WordPress, Drupal, Joomla and Magento sites. Fixes are out. Attackers are already trying.

Check my site, freeMessage us on WhatsApp
Severity
Critical, 9.2 out of 10
Who is hit
Sites on PHP, including WordPress, Drupal, Joomla and Magento
Fixed in
PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
Status
Patches out, attacks reported
Free exposure check · about 15 seconds

Is your website exposed right now?

Enter your website address and where to send the result. We look at what any visitor's browser sees, and tell you how serious it is and how many issues need urgent attention.

This is a basic outside view, not a full audit. We only request your home page once, like a browser would. We never log in, probe private files or change anything.

What is happening.

Both flaws are memory handling bugs in PHP, the software that runs most websites. An attacker needs no login and no vulnerable plugin. The risk is highest on Apache with mod_php, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are all affected. Researchers confirmed attacks against specific versions of WordPress, Drupal, Joomla and Magento.

  1. October 17

    First attempt recorded

    Amazon Threat Intelligence logs an exploitation attempt against its honeypots, four days before anyone is told. It advises starting any investigation from this date.

  2. October 21

    Patches released, alert issued

    The PHP project ships fixes for both flaws. CISA tells every organisation running PHP to patch immediately.

  3. October 21 onward

    Attacks reported

    Amazon says php2shell is now being exploited broadly. Cloudflare and watchTowr also report attempts. Public exploit code is circulating, though Tenable has not verified it. CISA said at publication it had not seen a successful attack.

  4. October 23

    CISA updates its alert

    It adds detection rules and tells owners who cannot patch, or who run PHP 8.1 or older, to take PHP systems offline until they are fixed.

Sources do not fully agree. CISA said at publication that it had not seen a successful attack. Amazon, Cloudflare and watchTowr report attempts, and Amazon calls the exploitation broad. We treat it as urgent either way, which is also CISA's advice.

Is your site affected?

Shared hosting does not make you safe by default. Your host controls the PHP version, so ask them. Apache with mod_php is the highest risk setup.

What an attacker can take.

Passwords and sessions

One of the bugs can leak memory from other visitors' requests. Wiz says that can expose passwords, authentication tokens, API keys and certificates.

Database and API keys

Code running on your server can read any file your site can read, such as wp-config.php or an .env file. Those hold the database password and the keys to your payment, email and CRM accounts.

Customer data

Orders, leads, user accounts and messages sit behind the same login. Whoever controls the server can read and copy them.

Your reputation

Attackers can deface a site, redirect visitors or plant a hidden backdoor so they can come back after you patch.

What to do today.

Seven steps, in order. Steps 1 and 2 are the urgent ones.

  1. Find your PHP version

    In WordPress, open Tools, then Site Health, then Info, then Server. On a hosting panel, look for "PHP version" or "Select PHP". Not sure? Ask your host, or ask us.

  2. Update PHP and restart it

    Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer, and restart PHP so the fix is actually running. On managed hosting, ask the host to confirm in writing which patched build you are on. Do not assume.

  3. Update WordPress, plugins and themes

    Updating WordPress alone does not fix this, because the flaw is in PHP. But keep everything current anyway. WordPress had its own critical flaw, wp2shell, fixed on July 17, 2026, and attackers used it to plant hidden backdoor plugins. Delete every plugin and theme you do not use.

  4. Cannot patch today? Reduce the risk

    PHP says these settings help but do not make you safe: set session.upload_progress.enabled to 0, set memory_limit to -1 where your site cannot override it, keep post_max_size at 8M, then restart every PHP worker. Put a web application firewall in front of the site. If you run PHP 8.1 or older and cannot move, CISA's advice is to take the site offline until it is fixed.

  5. Check whether you were already hit

    Look back to October 17. Warning signs: plugins or admin users you did not add, unknown PHP files in uploads or temporary folders, a burst of 500 errors, unusually large PHPSESSID cookies, and PHP processes restarting for no reason.

  6. Then change the secrets, in this order

    Only after the site is confirmed clean, or the attacker simply sees your new passwords. 1) Hosting, SFTP and SSH logins. 2) The database password. 3) The WordPress security keys and salts in wp-config.php. 4) Every admin password. 5) API keys and webhooks for payments, email, CRM and any other service. This ordering is our recommendation, based on standard practice. It is not part of the official advisories.

  7. Keep a clean backup and switch on automatic updates

    A tested copy stored away from the server is what saves you if the worst happens.

Keep passwords, codes and keys safe, for good.

Patching closes this hole. These habits limit the damage from the next one.

Keep secrets out of the public folder

Store passwords and keys in environment variables or a file above the web root, never inside a folder the internet can reach and never in code you share.

One password per site, service and person

Use a password manager. Reusing a password means one leak opens every door.

Switch on two factor sign in everywhere

Hosting, WordPress admin, email and payments. Use an authenticator app or a security key, not text messages.

Give each part only the access it needs

A separate database and user for each site, with only the rights it needs. Fewer admins. Turn off the built in plugin and theme file editor.

Update on a schedule, and remove what you do not use

Automatic updates for core and plugins. Abandoned plugins are a favourite way in, and 2026 has already seen plugin takeovers that stole login and database credentials.

Watch, back up, and rehearse

Log monitoring and file change alerts. A tested offline backup. And a written plan for rotating every secret in one afternoon.

Esipick offer · open until November 15, 2026

Free exposure check, then a fixed price fix.

For our existing clients and anyone new. Existing clients go to the front of the queue.

  1. 1A free 15 minute exposure check. With your permission, we look at your PHP version, WordPress core, plugins and themes, and whether you run an end of life version. You get a plain answer: exposed or not, and what it would take to fix.
  2. 2A fixed price for each site. You know the number before we start. No surprise invoices.
  3. 3We patch, test and lock it down. We update, check for signs of a break in, rotate your secrets in the right order, and send you a plain report of what we found and what we could not check.
Run my free check nowBook a call insteadWhatsApp us now

The check is free whether or not you hire us. We cannot promise a site is clean, and we will tell you plainly what we checked and what we could not. We reply within 4 hours on business days.

Questions we are asked.

Do I need a vulnerable plugin for this to hit me?

No. The flaws are in PHP itself, so even a simple "Hello World" page on an affected PHP version can be vulnerable. Wiz tested the attack against the latest official WordPress container image.

My host says they handle updates. Is that enough?

Maybe, but ask for proof. Ask which PHP build your site runs and whether it includes the October 21 fixes. Some hosts patch quickly, some use older versions with their own backports, and some have not started.

Is updating WordPress enough?

No. WordPress updates do not change the PHP version underneath. You need the PHP update, and WordPress, plugins and themes should be current as well.

Do I need to change my passwords?

If your site has been running an unpatched PHP, plan to, and do it in the order shown above once the site is confirmed clean. At minimum rotate the database password, the WordPress keys and salts, and every admin password.

What does the free check cost, and what happens after?

Nothing, and there is no obligation. You get a plain answer on whether you are exposed and what it would take to fix. If you want us to do the work, we give you a fixed price for each site before we start.

Sources

Checked on October 26, 2026. This situation is changing, so check these for updates. The step order for changing secrets is our own recommendation, not an official one.

Find out if your site is exposed. It is free.

Book a free 30 minute call