Blog

70 percent of the web is now facing a threat. Let us help you find a solution.

Addressing wordpress security flaws

We design server systems that just work. Redundant safe secure, and expandable our enterprise software is like no other.

At Steele Web IT Services our Team can build and manage your big data systems. Book a call today at steelewebservices.com/booking

**Critical PHP Security Alert — Including WordPress**

Two critical PHP vulnerabilities, **CVE-2026-109618 and CVE-2026-109619**, can allow attackers to execute code on affected servers without logging in. PHP released security fixes on October 21, 2026, and urges users to update immediately. These flaws affect the underlying PHP software, so updating WordPress or its plugins alone does not fix them.

The potential reach is enormous: **PHP powers 69.3% of websites whose server-side programming language is known.** WordPress, which runs on PHP, accounts for **39.6% of all websites** in W3Techs’ survey. These figures describe usage—not the number of websites confirmed vulnerable or hacked.

**Website owners should contact their hosting provider immediately** to confirm the PHP version serving their site has been patched. Fixed releases include **PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12**, or vendor packages containing equivalent security fixes.