On 21 October 2026 the PHP team published an advisory whose title leaves no room for doubt: «Critical remote code execution vulnerabilities, update now». If your business website is built with WordPress, it runs on PHP, and WordPress security depends on someone doing that update. Here is what happened, why it affects you even if you have no idea what PHP is, and the list of what to check this week.

What happened with PHP

PHP is the language WordPress runs on under the bonnet. According to W3Techs, it is used by 69.3% of websites whose server-side language can be identified (checked on 22 October 2026).

The official advisory on php.net describes two critical flaws (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on the server without logging in. It affects, the advisory says, «all PHP installations serving web requests». The fix is to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and the PHP team sums it up in one line: updating is the only safe choice.

One detail matters more than the version numbers: PHP 8.1 and older no longer receive updates from the project. This time the team released minimal patches for 7.4, 8.0 and 8.1, aimed at people who build PHP themselves. A server nobody touches does not fix itself.

Is my website affected?

If your site is WordPress, the question is not whether it uses PHP, but which version and who updates it. And here is an uncomfortable number.

WordPress.org publishes which PHP version is used by the sites that connect to its update service. Adding up the versions that are no longer supported (8.1 and older) gives 35.8% of WordPress sites (statistics checked on 22 October 2026). More than one in three. And 8.2, used by another 23.7%, stops receiving security patches on 31 December 2026, according to PHP's official schedule.

WordPress is no niche: W3Techs puts it at 39.6% of all websites. So when something breaks at its base, it breaks for everyone at once.

It is not only PHP: the summer of wp2shell

In July 2026 a chain of two flaws in WordPress core itself was made public, nicknamed wp2shell. According to the summary by INCIBE-CERT (Spain's national cybersecurity incident team, 28 July 2026), it let a remote attacker run code without logging in and without needing any plugin. WordPress released versions 6.8.6, 6.9.5 and 7.0.2 and switched on forced automatic updates for compatible installations.

Even so, INCIBE notes there was active exploitation of sites that had not been updated: webshells installed (a back door for controlling the server), administrator accounts created and malicious plugins added to stay inside. That is why INCIBE advised not just updating, but checking whether a break-in had already happened.

Plugins, the usual weak spot

WordPress core is the most closely watched part. The real risk sits around it. Patchstack, a company that specialises in WordPress security, counted 11,334 new vulnerabilities in 2025, 42% more than the year before. Of those, 91% were in plugins, 9% in themes and only 6 in core.

Two figures from the same report explain why this matters to a small business:

46% of vulnerabilities had no fix from the developer when they were made public.
For the most attacked ones, the weighted median time to the first mass attack was 5 hours.

In other words: even if you update, sometimes there is nothing to update to; and when there is, the window is measured in hours, not weeks. A contact form, a slider or a booking plugin that nobody has checked since 2023 is an open door.

A fair point: none of this means WordPress is bad. It is a huge, very capable tool. The problem is that a WordPress site is a server someone has to maintain, and in many businesses that someone does not exist.

The checklist: what to check this week

If you have a WordPress site, do this yourself or ask whoever built it:

Check your PHP version. In the WordPress dashboard: Tools → Site Health → Info → Server. If it says 8.1 or lower, you are unsupported.
Ask your hosting company whether they have applied the 21 October update. With this exact question: «Is my server already on PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or an equivalent patch from your distribution?»
Update WordPress, plugins and themes, in that order, after taking a backup.
Delete plugins and themes you do not use. Deactivated is not enough: the code is still on the server.
Turn on automatic updates for plugins you trust (WordPress has allowed this since version 5.5, plugin by plugin).
Check the administrator accounts. If there is one you do not recognise, do not just delete it: get help, because it may be a sign of a break-in.
Make sure there are automatic backups, and that one has actually been restored at some point.
Turn on two-step verification for your administrator account.

Doing it yourself: the full sum

Quick and once. Checking the PHP version and emailing your host: fifteen minutes. Do it today even if you do nothing else; it is free, and it is the question that matters most this week.

Slow, a long weekend. Updating everything, deleting what you do not need, checking accounts and testing that the site still works afterwards. If a plugin clashes with the new PHP version, the weekend gets longer. This is where the IT person who «takes a look» turns up, or the agency that charges for maintenance on top.

The part that never ends. With 11,334 new vulnerabilities in a year, this is not a task: it is a habit. There are updates every week, and any one of them can break something. That is why so many business websites end up with a plugin from 2022 and an unsupported PHP version: nobody had the time.

What we do

wiweb is not WordPress and does not run on PHP. It is a single page made of widgets — live opening hours, Google reviews, services and prices, a map, WhatsApp, bookings through the app you already use — that we host and maintain ourselves. There are no plugins to install and no PHP version to watch, because none of that is yours to touch.

The weekend shrinks to nothing: the server, the security certificate (issued and renewed automatically), the delivery network and protection against denial-of-service attacks are our job, on the free plan too. Every change keeps a copy and can be undone.

The part that never ends, too: platform updates are done by us, for every site at once. You change yours by typing, like a WhatsApp message.

Free, €0: your page with every widget, published at yourbusiness.wiweb.me, with legal pages and cookies included. No card, for good.
Grow, €9/month (€7.50/month paid yearly, excluding VAT): your own domain, no wiweb mark, a blog, three languages, your Google profile managed from wiweb, and a weekly review of your site and your profile with improvements you approve.

You can create your website free and see what each plan includes on pricing. The honest part: no system is invulnerable, ours included. The difference is who has to keep watch. And if you need a large multi-page website or an online shop, WordPress may well be right for you; in that case, make sure someone really maintains it.

FAQ

How do I know which PHP version my website uses?

If it is WordPress, under Tools → Site Health → Info → Server. If you have no access, ask your host or whoever built the site. Any version 8.1 or older no longer receives updates from the PHP project.

Does WordPress update itself?

Minor core versions usually do. Plugins and themes only do if you switch on their automatic updates one by one. And the PHP version does not depend on WordPress, but on your hosting company's server.

What do I do if I think my website has been hacked?

Do not delete anything yet. Change your passwords, tell your host and ask for a review. INCIBE runs a free cybersecurity helpline, 017, for businesses and the public.

Is a small website really a target?

Yes. Mass attacks do not pick businesses: they scan automatically for vulnerable installations. A small, unpatched site is as visible to a bot as a big one.

WordPress security: the 21 October PHP advisory and what to check on your business website