A Major PHP Vulnerability Has Been Discovered: What You Need to Know

More Cases. Better Clients. Real Results.

Start a Conversation with GAVL

It’s been widely reported that critical PHP vulnerabilities (PHP2Shell) surfaced this morning, prompting emergency security updates worldwide.  PHP is a common language used to build websites, including WordPress sites.

However, the problem goes deeper than an outdated plugin. PHP runs underneath websites, so a blog can look normal while its server remains vulnerable.

What Was Leaked?

The FBI Cyber Division has warned that “Two critical vulnerabilities have been identified in PHP,” identifying CVE-2026-109618 and CVE-2026-109619. Its alert said the flaws “could allow malicious cyber actors to remotely execute code in PHP core.” That means an attacker could potentially run unauthorized commands on an affected server.

The warning doesn’t, however, establish that your particular websites were breached.

Have WP Engine Users Been Affected?

As a WP Engine user here at GAVL, we want to reassure you that no one has established that any of our sites have been compromised. As of this posting, there has been no public WP Engine announcement confirming any customer breaches or completion of platform-wide PHP2Shell patching.

WP Engine publishes PHP upgrade guidance, which we’re following, and we’re monitoring both vulnerabilities across our production, staging, and development sites.

What Does This Mean for Your Blog’s Safety?

An unpatched PHP environment can put blog content and sensitive information at risk despite strong passwords and could interrupt publishing and customer communications. Those are potential consequences, not confirmed incidents. The immediate concern is whether the underlying servers have been patched.

The Associated Press reported that some websites have temporarily gone offline as operators address the vulnerabilities, but not due to them. That national-level reporting explains the urgency but doesn’t establish any specific WP Engine breach.

What Should You Do Now?

Take a deep breath while we initiate PHP patching and monitor for any suspicious activity.

PHP identifies fixed releases as 8.2.35, 8.3.36, 8.4.27, and 8.5.12, with vendor-specific options for some older installations. Its developers warn that temporary mitigations aren’t a complete solution, and that site owners should coordinate the update with whoever manages your server.

That’s us, and rest assured, GAVL is on top of it, and your content is safe!