What Was Disclosed
On Tuesday, October 21, 2026, the developers of the PHP programming language announced they had identified two critical vulnerabilities in PHP and urged users to prepare to update their sites as soon as a fix was released. On Wednesday, October 22, they confirmed that a new version containing emergency fixes for those vulnerabilities was live.
What makes this disclosure extraordinary is not just the severity rating — it is the blast radius. PHP is the engine room of the web. According to web technology tracker W3Techs, PHP runs roughly 75% of all websites whose programming language can be identified. WordPress, Drupal, Joomla, and Magento — the content management systems and commerce platforms behind hundreds of millions of sites — all run on PHP. As Tiffany Farriss, interim chief executive of the Drupal Association, put it: “This issue impacts the majority of the Internet.”
Even more unsettling: the vulnerabilities had reportedly remained undetected for years, and servers running PHP versions released over the past 20 years are believed to be exposed. That means this is not a bug introduced in last month’s update — it is a flaw that has been sitting quietly inside the web’s foundation for as long as some of today’s developers have been alive.
Why Security Experts Are Sounding the Alarm
Critical vulnerabilities surface every year, and most are patched quietly before they ever make headlines. Three things make this one different.
1. The scale is almost incomprehensible
Most software flaws affect one product or one vendor’s ecosystem. This one affects the language itself — the layer underneath the applications. Every WordPress blog, every Drupal government portal, every Joomla community site, and every Magento storefront sits on top of PHP. A single flaw at that layer multiplies across three-quarters of the identifiable web.
2. The flaws hid in plain sight for years
PHP is open-source software with its code visible to the entire world. Thousands of developers read it, and automated tools scan it constantly. The fact that these vulnerabilities survived undetected for years is a sobering reminder that “many eyes” is a hope, not a guarantee. It also means there is no reliable way to know whether the flaws were quietly discovered — and exploited — by someone else long before this week’s disclosure.
3. AI is accelerating the race to exploit
This is the detail that has cybersecurity professionals most on edge. Costin Raiu, co-founder of cybersecurity research and incident response firm TLP, warned that AI is powering a “race to exploit,” and that the next stage could involve the mass compromise of vulnerable web servers worldwide. The logic is grim but simple: now that the patches are public, attackers can compare the fixed code against the vulnerable code, pinpoint exactly what changed, and use AI systems to hunt for unpatched servers at internet scale — automatically. Defenders are patching as fast as they can; attackers only need to find the ones that are slow.
Which Websites Are Affected
If your website runs on any of the platforms below — or on custom code written in PHP — you should assume you are affected until you have confirmed otherwise with your hosting provider.
| Platform | Why it matters | Estimated footprint | First step |
|---|---|---|---|
| WordPress | Powers over 40% of all websites; every WordPress site runs on a PHP-installed server | Hundreds of millions of sites | Check Site Health → Info → Server; ask your host to update PHP |
| Drupal | Widely used by governments, universities, and enterprises | Government and institutional portals worldwide | Follow Drupal Association security guidance; update via host |
| Joomla | Popular community and small-business CMS | Millions of sites | Update PHP through hosting control panel |
| Magento / Adobe Commerce | E-commerce platform handling payments and customer data | Tens of thousands of stores | Coordinate with your developer — stores need careful testing |
| Custom PHP applications | Bespoke codebases with no auto-update path | Countless internal tools and web apps | Developers must patch the server PHP build directly |
Security plugin maker Wordfence issued a warning that every WordPress site owner should read twice: all WordPress sites run on a PHP-installed server, and automatic updates will not apply this fix. Updating WordPress itself, your theme, and your plugins — the routine maintenance most site owners do — does nothing against this flaw. The fix lives one layer deeper, at the server level, and in most cases only your hosting company (or your server administrator) can apply it.
What Is Happening Right Now
The response from governments and infrastructure operators shows how seriously this is being taken:
- Government websites across Europe — and elsewhere — were taken offline on Wednesday as a precaution. Agencies in the Netherlands and Finland were among those that pulled sites down ahead of the fix rather than risk leaving them exposed.
- The Dutch National Cyber Security Centre itself temporarily went offline, saying it had done so as a precaution due to the vulnerabilities — a striking signal when the agency warning everyone else cannot keep its own site up with confidence.
- Wikipedia’s operator said it had taken an unspecified number of systems down for patching.
- Cybersecurity agencies in Europe, Australia, Japan, and Britain urged website operators to apply the fixes immediately or take their websites offline until they could be secured.
- Cloudflare, whose network sits in front of a huge share of the web, is updating its firewall rules as a stopgap measure. But its chief technology officer, Dane Knecht, was blunt about the limits of that protection: “We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update.”
The phrase “early attacks emerging” deserves emphasis. Within hours of the disclosure, malicious actors were already probing for vulnerable systems. This is the AI-accelerated race Costin Raiu warned about, playing out in real time.
What Website Owners Must Do Today
If you run a website — even a small blog nobody has heard of — automated scanners do not care how important you think your site is. They sweep the entire internet looking for unpatched servers. Here is what to do, in order:
Step 1: Find out your PHP version right now
WordPress users: go to Tools → Site Health → Info → Server. Your PHP version is listed there. cPanel users: look for “Select PHP Version” or “MultiPHP Manager” in your hosting control panel. Everyone else: ask your hosting provider directly — “What PHP version is my site running, and has the October 2026 emergency security release been applied?” If your host cannot answer that question clearly, consider it a red flag about the host itself.
Step 2: Get the patched PHP release applied
For most site owners on shared or managed hosting, this means contacting your hosting company and asking them to move your site to the latest patched PHP release. Many quality hosts apply security patches to their PHP builds automatically within hours — but “many” is not “all,” and you should verify rather than assume. If you manage your own server (VPS or dedicated), update your PHP packages from your operating system’s repositories or the official PHP builds immediately, then restart your web server.
Step 3: Back up before you touch anything
Take a full backup — files and database — before changing PHP versions. Major PHP version jumps can break older plugins, themes, or custom code. A backup means you can roll back if the update causes problems, instead of choosing between a broken site and a vulnerable one.
Step 4: Test critical functionality after updating
Once PHP is updated, walk through your site’s essential functions: contact forms, checkout pages, login areas, and any custom features. If something breaks, the culprit is usually an outdated plugin or theme rather than the PHP update itself — update those too, or temporarily replace them.
Step 5: Turn on a web application firewall if you do not have one
A WAF — from Cloudflare, Sucuri, Wordfence, or a similar provider — filters malicious requests before they reach your server. It is not a substitute for patching (Cloudflare’s own CTO said exactly that), but it buys you meaningful protection during the window between disclosure and patch, and it continues to block automated exploit attempts afterward.
Step 6: Watch for signs of compromise
If your site was running a vulnerable PHP version while the flaws were publicly known, assume it may have been probed. Look for unfamiliar administrator accounts, unexpected files, recently modified core files, and strange outbound traffic. When in doubt, restore from a known-clean backup made before the disclosure and change all passwords and API keys.
Your Options Compared: Patch vs. Firewall vs. Going Offline
Not everyone can patch instantly. Here is how the three defensive options stack up:
| Option | Protection level | Downtime | Best for |
|---|---|---|---|
| Apply the PHP security update | Highest — removes the vulnerability itself | Minutes (brief restart) | Everyone, as the final goal |
| Enable/update WAF rules | Partial — blocks known attack patterns, not the flaw | None | Immediate stopgap while arranging the patch |
| Take the site offline temporarily | Complete — nothing exposed, nothing to exploit | Total until patched | High-value targets that cannot patch within hours |
The government agencies that pulled their sites offline chose the third option — maximum safety at maximum cost. For a business that depends on its website for revenue, the realistic path is the second option immediately (WAF rules updated) and the first option as fast as humanly possible (the actual patch).
The AI Angle: Why This Disclosure Is Different From Past Ones
Security researchers have a term for the period after a patch is released but before everyone has applied it: the “patch gap.” Attackers have always tried to exploit it. What is new in 2026 is the speed and scale at which the gap can now be worked.
When a fix is published, the changed lines of code effectively publish a map of the vulnerability. In the past, turning that map into working exploits and then finding vulnerable servers took skilled humans days or weeks. Today, AI systems can analyze the code diff, generate exploit probes, and scan the internet for unpatched servers far faster than human teams can. That is the “race to exploit” Costin Raiu described — and the early attack activity Cloudflare is already seeing suggests the race is underway.
There is a bitter irony here worth noting: the vulnerabilities themselves went undetected for years despite PHP being open-source, while AI is now compressing the exploitation timeline to hours. Defense has to move at machine speed too — which, for most website owners, simply means: do not wait for the weekend. Patch now.
Frequently Asked Questions
Is my WordPress site affected even if WordPress itself is fully updated?
Yes. This vulnerability is in PHP, the language WordPress runs on — not in WordPress core, your theme, or your plugins. Updating WordPress does not fix it. As Wordfence warned, automatic WordPress updates will not apply this fix. You need the patched PHP release installed at the server level, which usually means action by your hosting provider.
How do I know if my hosting company has already patched PHP?
Check your PHP version (WordPress: Tools → Site Health → Info → Server; cPanel: Select PHP Version) and compare it against the emergency release your host announced. Then contact your host and ask directly whether the October 2026 PHP security fixes are applied to your server. Reputable hosts published notices within hours of the disclosure — check your host’s status page or blog.
Will updating PHP break my website?
It can, if your site relies on very old plugins, themes, or custom code written for long-retired PHP versions. That is why you back up first and test afterward. But weigh the risks honestly: a temporarily broken feature is recoverable from a backup; a compromised server can mean stolen customer data, a hijacked site serving malware, and a long, expensive cleanup.
I have a firewall / Cloudflare in front of my site. Am I safe?
Safer, not safe. Cloudflare is updating its firewall rules to block emerging attack patterns, and its CTO explicitly called that a stopgap, not a fix. WAFs block known patterns; a determined attacker probing a genuinely vulnerable PHP build may find a way around them. Treat the firewall as the lock on the door while you fix the broken window — necessary, but not the whole job.
What if I cannot reach my hosting provider or they have not patched yet?
Enable a web application firewall immediately (Cloudflare’s free tier is a reasonable emergency option), make sure you have a recent clean backup stored off-server, and keep pressing your host. If your site handles payments or sensitive personal data and you cannot get patched within a day or so, seriously consider the approach European government agencies took: temporarily take the site offline rather than leave customer data exposed to active exploitation.
The Bottom Line
A critical flaw sat inside the foundation of three-quarters of the web for years. Now it is public, the fix is public, and AI-accelerated attackers are already racing to find everyone who has not patched yet. Governments are taking websites offline. Cloudflare is scrambling firewall rules. Wikipedia is patching systems. The window for a calm, orderly update is measured in hours, not weeks.
Check your PHP version today. Get the emergency release applied. Back up first, test afterward, and put a firewall in front of everything in the meantime. This is one of those rare moments in web security where the right move is simple, the cost of delay is obvious, and “I’ll do it this weekend” is the most dangerous sentence in the English language.
Reporting on this story is developing. Key facts in this article are drawn from Reuters and Dawn reporting published October 22, 2026, including statements from PHP’s developers, the Drupal Association, Cloudflare, Wordfence, and cybersecurity researchers. If your hosting provider issues specific guidance for your platform, follow it.
