Critical PHP security flaw: what publishers need to know

PHP Update

Created: October 22nd.

On October 21, 2026, the PHP team fixed two critical security flaws. PHP is the software that runs most websites, including every WordPress site. The flaws let an attacker take over a web server from anywhere on the internet, with no password needed.

What to do: make sure your site runs one of the fixed PHP versions as soon as possible. Updating WordPress, themes or plugins does not fix this. The fix has to happen on the server.

Why it matters

An attacker who gets in has the same control over your site as your own developer. Researchers rate both flaws 9.2 out of 10 for severity. Attacks have been reported since the fix came out, so we expect more soon.

If your site is hit, the attacker could:

• Change your pages, add spam or send visitors to harmful sites
• Inject unwanted ads or swap out your ad code, which costs you revenue and can get your site flagged by Google and ad partners
• Steal stored data such as passwords, API keys, user accounts, and email addresses
• Use your server to attack others or send spam, which can get your domain blocklisted
• Leave a hidden back door to get in again later, even after you patch

Are you affected?

If your site runs on PHP, assume you are affected until you have checked. That includes every WordPress site.

1. Find your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open Server. Your hosting control panel usually shows it too.
2. Compare it with this table.

3. Check with your host if unsure. Some hosts patch PHP without changing the version number. An older number does not always mean you are exposed, so ask them to confirm.

What to do

Who does the work depends on how your site is hosted.

Is your site on managed WordPress hosting, such as WP Engine, Kinsta, or Pressable? Then your host fixes it for you. What you can do is confirm with them that the fix is live on your site.

Is your site on shared hosting, usually with cPanel or a similar control panel? Then your host fixes it too. What you can do is ask them directly whether the October 21 PHP update is installed.

Does your site run on your own server or a cloud server, such as DigitalOcean, Hetzner, or AWS? Then you or your developer need to fix it. What you can do is install the updated PHP today and restart PHP so the fix takes effect.

Not sure which one applies to you? Ask whoever built or looks after your site, or get in touch with us.

If you run PHP 8.1 or older: move to PHP 8.2 or newer. Test on a copy of your site first, since older themes and plugins can break. Take a full backup before you switch. If you can't upgrade quickly, consider taking the site offline until you can.

If you use Cloudflare: it has added protection rules against these attacks. On paid plans, check that the managed rules are set to block. This helps, but it does not replace the update.

If you can't update today: ask whoever manages your server to turn off the PHP setting called upload progress (session.upload_progress.enabled = 0) and restart PHP. WordPress does not use this feature. It lowers the risk but does not remove it.

Questions to ask your host:

• Have you installed the October 21, 2026 PHP security update on the server that runs my site?
• Which PHP version does my site run now?
• Is the fix on the server itself, or only on a firewall in front of it?
• Can you check the logs for signs of an attack from before the update?

Warning signs of an attack

Patching stops new attacks, but it does not remove an attacker who is already in. Look out for these signs, especially if your site was unpatched after October 21.

What you or your visitors might notice:

• Pages that redirect to other sites, or pop-ups and ads you didn't add
• New or changed content you don't recognize, often spam or links to shady sites
• New admin users in WordPress that nobody on your team created
• A sudden drop in ad revenue or a jump in traffic from odd places
• Google warnings such as "This site may be hacked", or alerts in Google Search Console
• Your host or email provider reporting spam or unusual activity from your server
• The site getting slow or crashing without a clear reason

What your developer or host can check:

• New or changed PHP files in the website folders, especially in upload or temp folders
• New scheduled tasks or new user accounts on the server
• PHP starting other programs, or the server connecting to unknown addresses

If you see any of these, don't just delete files. Keep the logs, change your passwords and API keys, and get help. Removing an attacker properly takes care.

We're here to support

Do you need help checking your site, talking to your host, or reading any of the warning signs above?

Please reach out to your Publisher Collective account manager or reply to the message this came with. Our engineering team will help you work out where you stand and what to do next.

Our ad code on your pages does not depend on your PHP setup. The risk sits with the web server that runs your site.

Sources: PHP.net security advisory · CERT-EU advisory 2026-018 · Help Net Security · Huntress · Codeable guide for WordPress owners

‍