Probably, unless someone has already patched the server it runs on. The flaw is in PHP itself, the language WordPress is written in, so nearly every WordPress site in the world was exposed until its server was updated.
Nicknamed PHP2Shell, it was disclosed on 20 October 2026 and has led the news since, with government services offline in the UK and Canada and companies taking sites down as a precaution.
What happened
Two flaws were found in PHP, the programming language that runs WordPress and, according to security firm Wiz, around 70% of the web. They are catalogued as CVE-2026-109618 and CVE-2026-109619, and PHP rates both 9.2 out of 10 for severity. Both let an attacker run their own code on a web server without logging in first. PHP published emergency patches the same day.
The flaw sits one level below WordPress, in the software your server uses to run it. A perfectly up-to-date WordPress site on an unpatched server was still exposed.
How to check which PHP version you are on
In WordPress admin, go to Tools → Site Health → Info and open the Server section. Your PHP version is listed there.
The patched releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. An older release within those branches still needs updating. Anything on PHP 8.1 or below is past end of life, which is a bigger conversation than this one flaw.
The server also has to have been restarted after the update for it to take effect, which is not something you can see from inside WordPress.
Who is responsible for patching it?
Charlotte Wilson of Check Point, speaking to Radio 4’s World at One, warned small businesses not to assume somebody else has fixed it. Even where a hosting provider looks after the underlying server, responsibility for the software your business runs on can still sit with you.
In practice it depends what you are paying for:
- Shared or reseller hosting. The host patches the server on their own schedule. You find out afterwards, if at all.
- A VPS or cloud server you rent. The server is yours to patch. The host provides hardware and network, nothing above that.
- Managed hosting through a developer or agency. They should be patching it, and should be able to tell you when they did.
Large organisations with their own IT departments patched within hours, according to researchers quoted by the BBC. Smaller firms sat in a queue at whoever manages their systems. At 15:30 on Thursday 22 October, two days after the patches were published, only 5.34% of at-risk UK systems had been updated.
What to do now
If you are not sure who patches your server, that is the thing to resolve, and it is worth resolving today rather than the next time this happens. Ask whoever hosts your site two questions: which PHP version are we on, and when was it last updated. A straight answer to both is a good sign. Having to chase for it tells you something too.
Beyond the patch itself, Check Point’s advice to small businesses was to make sure you have a backup you have actually tested restoring, kept separately from the live site and to keep monitoring the site afterwards. Nobody has reported a confirmed breach from this flaw yet, but as Wilson pointed out, you usually do not know someone has managed it until something goes wrong.
If we look after your site
Our servers run PHP we manage ourselves, so these were patched within an hour of the release, without anyone needing to ask. Every site we host also has daily off-site backups kept for 30 days and uptime monitoring, which is what you fall back on if a flaw goes public before a patch reaches you.
If you are not with us and you cannot get a straight answer about your PHP version, tell us what you have got and we will take a look.
Xinc Digital is led by me, Mark. I’ve spent over 20 years building and maintaining WordPress sites across hosting infrastructure, custom plugin development, WooCommerce, security, and performance. By now I’ve seen most of what can go wrong.
When you’re on a care plan, you work directly with me. I’m the person who knows your site, handles your updates and responds when something needs attention.
I also work with a group of developers I’ve collaborated with for years, so there’s always cover, and extra hands when a job needs them.
I’m straightforward about scope. Care plans cover technical work: updates, security, fixes, performance.