On October 21 the PHP project shipped an emergency fix for two critical security flaws. Government sites, parts of Wikipedia and other large sites went offline to wait for it. Sites on Elevation’s hosting and support plans were protected the same day, with nothing for anyone to do. If your site is not with us, here is what to check.
What happened
On October 21 the PHP project released an emergency fix for two critical security flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10). PHP is the programming language underneath WordPress, Drupal and about 69% of all websites. The flaws let an attacker run their own code on a web server without logging in. And because they live in PHP itself, a site with WordPress, its theme and every plugin fully up to date was still exposed.
The fix was scheduled for October 22. The day before, the vulnerability IDs leaked, a proof-of-concept video got out, and one vendor published patched software six hours before the coordinated release. The PHP team pulled the release forward to October 21 at 14:00 UTC. CISA, the UK’s National Cyber Security Centre and the EU’s CERT-EU all told organizations to patch immediately or take PHP-based systems offline until they could.
Many did. Parts of Wikipedia, Pinboard, 4chan and Something Awful went dark to wait for the patch. The Government of Canada took some federal websites offline “as a precaution.” Daycare systems and game servers in Japan did the same. For most organizations, the choice on Wednesday morning was a few hours of downtime or a few hours of exposure.
What it meant for the sites we host
Nothing. That is the whole point.
Sites we host run on Pressable, Automattic’s managed WordPress platform, and we maintain them as an Automattic Pro Partner. The PHP fix went public at 14:00 UTC on October 21. Automattic had worked with the PHP security team directly, and its notice went out the same day: every site on WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr was already protected, on every PHP version offered, including staging and sandbox copies. Pressable’s message to partners like us was short: “There’s nothing you need to do. You don’t need to update PHP or change any settings.”
Attackers were probing for the flaw more than six hours before the fix existed. On the platform our sites run on, it was closed within hours of the fix being published. So on Wednesday, while IT teams elsewhere were deciding whether to pull their sites offline, our support team’s job was to confirm the protection across the 200-plus nonprofit sites we host, check the logs for exploitation attempts, and go back to the queue. No downtime. No emergency email asking clients to do something. No executive director had to learn what a PHP version is.
That is what “monitored around the clock” is supposed to mean in practice.
If your site is not with us: check these today
The fix only helps once it is on your server, and updating WordPress, your theme or your plugins does not install it. Five things to do, in order:
- Find your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, then Server. The line that says “PHP version” is the one that matters. If you do not have admin access, your host’s control panel shows it too.
- Compare it to the fixed releases. You are covered on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or any higher number in the same line. Anything lower in those lines has not been patched.
- If you are on PHP 8.1 or older, there is no fix for you. Those versions no longer receive security updates. CISA’s advice is to take the site offline until it is upgraded. Most hosts can move a WordPress site to PHP 8.3 in minutes. Ask for it today, and test your forms and donation pages afterward.
- Ask your host in writing. “Have CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) been patched on the server that runs my site, and when?” A good host answered this before you asked. A host that cannot answer today is telling you something.
- Assume someone knocked. Cloudflare saw attack attempts hours before the patch was public, and Patchstack received reports of active exploitation. Once you are patched, look for admin users you do not recognize, files changed in the last two days, and bursts of HTTP 500 errors or PHP memory-limit errors in your logs. Then take a fresh backup.
If you cannot patch today, a web application firewall such as Cloudflare’s is a stopgap. It is not a substitute for the update.
The part nobody notices when it works
We get asked, fairly often, why a nonprofit needs a support plan when the site is “already hosted somewhere.” This week is the answer.
Hosting is the server. A support plan is the server plus the people who read the security advisories at 6 a.m., know which of your sites run which PHP version, confirm the fix actually landed, and look at the logs afterward. In a normal month that work is invisible. On a day like October 21 it is the difference between a site that stayed up and an executive director hearing about a CVE from a board member.
Every Elevation support plan includes:
- Hosting on Pressable, maintained by us as an Automattic Pro Partner, with the infrastructure layer monitored around the clock
- Software and security updates, backups and uptime monitoring, done every month and summarized in a monthly health report
- Plugin and integration upkeep: your CRM, your donation platform, your forms
- A block of support hours for content changes and small fixes, with urgent issues jumping the queue
We maintain sites we did not build, too. Every plan starts with an audit of the site as it stands, so the first thing you get is an honest list of what needs attention.
What to do now
If your site is on a plan with us: nothing. You are done reading.
If it is not: run the five checks above today, not next week. And if you would rather have someone do it for you, and keep doing it, book a call. We will start with an audit of where your site stands and tell you plainly what it needs.
