PHP vulnerability of October 21, 2026: all our clients' WordPress sites are up to date

All of our clients' WordPress sites are up to date: the critical PHP flaw fixed on October 21, 2026 no longer affects them. It took an intense day for our team to get there. Starting that morning, we checked every site, then updated the ones that needed it. Everything was done by the end of the day. If we manage your site, there is nothing for you to do.

What happened

PHP is the programming language that WordPress and a large part of the web run on. On October 20, its maintainers announced a security release for the next day. It came out on October 21 at 10 a.m. (Montreal time).

It fixes two flaws (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10 for severity. According to the PHP advisory, they can let an attacker run code on the server without an account, before the site even loads. The advisory is clear: no temporary measure replaces the update.

Why WordPress was affected

The flaw is in PHP, not in WordPress. No WordPress or plugin update fixes it: the fix is installed on the server. It exists for PHP 8.2, 8.3, 8.4 and 8.5. Versions 8.1 and older no longer receive updates from PHP. A site therefore had to run PHP 8.2 or higher to receive the fix the normal way.

What we did on October 21

We got to work on the morning of October 21, as soon as we were notified. The sites we manage were all on a PHP version supported by their host. We checked each one, then moved the ones that needed it to PHP 8.4 so they could receive the fix. All updates were completed that same evening.

A day like this can't be planned. A flaw this serious gets fixed the day it is announced: that is a big part of what our website maintenance service does.

What you need to do

If Falia manages your site, there is nothing to do: it is up to date and protected against both flaws. If someone else maintains your site, ask them which PHP version it runs. A version older than 8.2, or an 8.2 to 8.5 version that has not received the October 21 update, calls for quick action.

PHP 8.2 stops receiving security fixes on December 31, 2026. A site that still runs that version is better off moving to a newer one before then.

What we have been seeing for a few months

The October 21 flaw is not an isolated case. With the advances in AI, we are seeing many more security flaws to fix on WordPress sites. In two months, from late August to mid-October 2026, the time our agency spends on WordPress updates and security nearly doubled: up 96% from the previous two months.

On a WordPress site, every announced flaw calls for a check, often the same day. That is one of the reasons we are offering our clients another path.

Why we are migrating WordPress sites to Astro

We have started migrating our clients' WordPress sites to Astro, the framework our own site is built on. Major brands use it for their websites: Porsche, Michelin, Cloudflare and Proton. Our clients gain security, agility and speed of execution. On the security side, an Astro site uses neither PHP nor a database: the October 21 flaw could not affect it. An attacker also finds far fewer ways in. On speed, the gap is clear: in September 2026, 71% of Astro sites delivered a good mobile experience according to Google's Core Web Vitals (the measures of page speed and stability), compared with 48% of WordPress sites.

AI has made this approach accessible. A coded site used to need a developer for every change. With an AI-managed website, your site is 100% editable in plain language: you describe the change and the AI makes it. These projects remain affordable for a small business.

If you would like to know what moving your WordPress site to Astro would cost, write to Gabriel at ggervais@falia.co for a quote.