Governments took their own websites offline this week. Is your WordPress site next?

What happened

On October 21, 2026, the PHP project shipped emergency fixes for 2 flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10. Both let an attacker run their own code on a server without logging in.

PHP is the language underneath WordPress, Joomla, Drupal, Magento and Wikipedia's MediaWiki. Cloudflare says almost 70% of websites use it. Wiz Research, one of the teams that found the flaws, says every PHP version released in the last decade, back to 5.4, is hit by at least one of them. The researchers named it PHP2Shell.

What can an attacker do with it? Wiz says take control of the server, steal data and deface the websites running on it. The memory exposed can hold passwords, login tokens and API keys.

The timeline

1. Oct 17Amazon's threat team caught an exploit attempt against one of its decoy servers, from an anonymized address, while the flaw was still secret. (AWS)
2. Oct 20The PHP security team gave advance notice: 2 critical flaws, fix coming the next day at 9:00 AM Central. It reserved the right to release early if details went public. (php.net)
3. Before the releaseDetails leaked before the patch was out. Cloudflare says it saw attack traffic aimed at its customers and watched attackers change their payloads to slip past its new firewall rules. (Cloudflare)
4. Oct 21, 7:55 AM CentralJapan's prime minister, Sanae Takaichi, posted an urgent request at 9:55 PM Tokyo time asking the whole country to act that night. Her post has passed 86 million views. (X)
5. Oct 21, before the fixThe Dutch government took Overheid.nl, MijnOverheid.nl and DigiD, its national login for government services, offline as a precaution. (Rijksoverheid)
6. Oct 21, 8:45 AM CentralThe NSA told every organization using PHP to get ready, and to take systems offline if they can't update right away. (X)
7. Oct 21, 9:00 AM CentralPHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The FBI, CISA and the UK's NCSC followed with their own warnings within hours.
8. Oct 21, rest of the dayFrance's Interior Ministry put all of its websites into maintenance. Finland's state IT provider took government network services offline. Denmark's municipal IT company shut down services, including the national school platform. The Czech government took its website down that evening. (Sky News)

The next morning, Takaichi posted again. Her own official website had been taken offline the night before. Her office called the site and server managers right away, cut off access, fixed it and brought it back. She said it reminded her that, depending on the situation, taking a site down for a while can be the right call.

Think about that. A head of government had her own site pulled the same night. Is anyone watching yours?

What they said

Our translation of the prime minister's post: “An urgent request for everyone to act on tonight. ... Please check whether your public websites use PHP, and be ready to apply the fix being released tonight at 11 PM Japan time as quickly as you can. If you can't apply it quickly, temporarily stopping the website is one effective way to reduce the risk.”

If you want the whole wild day in one breath, read this post from @fiveoutofnine, seen more than 2.8 million times. It opens: “today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse.”

Why AI makes this worse

AI helped find these flaws. It's helping the attackers too.

The bugs sat in PHP for more than a decade. Wiz says turning them into a working attack used to sit at the edge of what human researchers could pull off, and frontier AI models let its team build working exploits across several applications in hours.

The same tools are in everyone's hands. Cloudflare wrote on launch day that AI agents scanning for weaknesses “can be extremely persistent, adapting payloads using feedback.” Alp Toker of NetBlocks told Sky News: “Now the patch is out, AI agents can learn from that patch and reproduce the attack much more easily.”

Cloudflare CEO Matthew Prince described how fast it moved: “In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.” (Reuters)

Why an outdated WordPress site is a liability

Most owners set up a site, paid for it once, and moved on. Every plugin, theme and server underneath it kept aging.

• It can get taken over. A hijacked site can show spam, send visitors to scam pages or quietly copy what people type into your forms.
• It can scare customers away. Google and browsers warn people about hacked sites, and a customer who sees a warning usually goes back to the search results.
• It can sink your search rankings. Spam pages and warnings take time to clear from Google even after the site is fixed.
• Cleanup costs real money. You pay for the repair, the downtime and the work you lose while the site is broken.
• It needs someone on call. This fix landed at 9:00 AM Central on a Wednesday. In Japan it landed at 11 PM. Who on your team would have caught it?

I manage 60-plus WordPress sites, and alerts like this come in all the time. In June I wrote about moving business sites to plain HTML pages, partly because every theme and plugin is one more thing to patch. This week the hole was in PHP itself, underneath WordPress.

Turn the liability into a growth engine

Every business with an aging site has to do something now. You can patch it and wait for the next alert, or you can rebuild it into something that brings in customers.

We rebuild your current WordPress site as a Smart Business Site that we host. We set up update rules around how your business runs, so the site changes on its own when a trigger hits. When you want something else changed, send us an email, a text or a voicemail. Minor edits are free, and most go live the same day.

The result is a site that stays current, loads fast on a phone and turns visitors into calls and bookings.

A 5-minute check for business owners

Anyone can do this. Ask these questions today.

1. What PHP version am I on? In WordPress, go to Tools, then Site Health, then Info, and open Server. You want 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. Can't log in? Ask your host by email so you have the answer in writing.
2. Am I on PHP 8.1 or older? Those versions are end of life. The PHP team sent out minimal fixes for 7.4, 8.0 and 8.1 because this one is so serious, but your host has to apply them. Ask if they did, and plan the move. PHP 8.2 reaches end of life on December 31, 2026.
3. When were WordPress, the theme and the plugins last updated? Check Dashboard, then Updates. Months of pending updates means nobody is watching.
4. Who manages the site? Write down a name. If the answer is “my nephew” or “the company that built it in 2019,” that's your answer.
5. Is the site behind Cloudflare? Cloudflare added protection for these flaws on every plan with its firewall turned on, including free plans. It still says to patch.

Questions owners are asking