A PHP flaw is hitting WordPress sites. What it means for you

On 21 October 2026 the PHP team released an emergency update for two severe security flaws. PHP is the programming language underneath WordPress, Joomla, Drupal and Magento, among others, so a large part of the internet runs on it. Both flaws score 9.2 out of 10 and let an attacker run their own code on the server without logging in. That is why many websites were put into maintenance mode as a precaution.

What many people do not realise: you cannot fix this with a WordPress update. The flaw sits in PHP itself, on the server, underneath WordPress and all your plugins. Your host needs to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you still run PHP 8.1 or older, PHP itself no longer releases updates for it, so you stay vulnerable unless your host takes extra action.

If you have a WordPress site, do the following. Ask your host which PHP version you use and whether the emergency update has been applied. Make a fresh backup and keep it off the server. If you are on PHP 8.1 or older, plan a move to a newer version. Also check for files on your site that you do not recognise, because attackers often use flaws like this to plant a backdoor.

What about our sites? The websites we build on Lovable do not run on PHP, so this flaw does not affect them. That is not because we can never get anything wrong, but because this specific flaw does not fit the way we build. We keep checking and maintaining all our sites as usual. Not sure about your own WordPress site? Let us know and we will take a look.