Last week a hole in PHP was news. Now it is being attacked.

PHP is the software behind a huge share of the web. WordPress, Drupal, Joomla and Magento run on it. One security firm (Wiz) puts it at about 70% of websites.

The two flaws are CVE-2026-109618 and CVE-2026-109619. Both rate 9.2 out of 10. An attacker can run their own code on a web server without logging in. The weak code goes back to PHP 5.4, released in 2012.

What changed

The fixes are out. PHP released them October 21: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Attacks came first. Amazon saw an attempt on October 17, four days before the fix. Cloudflare and others saw more on the 21st. Amazon now says the flaws are broadly exploited. Researchers disagree on whether any attack has fully worked. Nobody disagrees that the attempts are real.

WordPress is not the problem. WordPress.org says no WordPress update is coming. The flaw is in PHP. Updating WordPress does not update PHP. Your web host does that.

Older PHP is stuck. PHP 8.1 and older get no normal update. The PHP team posted source-code fixes for 7.4, 8.0 and 8.1 for people who build their own. PHP 7.3 and older get nothing. PHP 8.2 loses support December 31. Aim for 8.3 or newer.

A site offline is not necessarily hacked. Dutch government sites, including DigiD, went offline. So did BambooHR. The UK's National Cyber Security Centre said any system that cannot be fixed quickly should come offline. Many sites followed. A site that is down may be down on purpose.

Hosts are mid-patch. As of Thursday, WP Engine, Kinsta and Hostinger said they were done. GoDaddy's managed WordPress hosting was patched. Its regular web hosting was still on stopgap protection. Bluehost was partly done.

What to do

Hosted builders like Wix, Squarespace and Shopify run the servers themselves. You install nothing.

WordPress or another PHP site on regular hosting: email your host and ask which PHP version you run and whether the October 21 fix is installed. Get the answer in writing. In WordPress, Tools, then Site Health, then Info, then Server shows your PHP version. Hosts often patch without changing the number, so ask anyway.

Your own server: update PHP, then restart it so every process uses the new code.

Not sure what you have? Reply and I will look it up. It takes a few minutes.

If your site did anything strange since October 17, tell me. Unfamiliar admin users, files you did not add, or visitors sent somewhere odd.

As a visitor, you install nothing. Be wary of odd redirects, surprise downloads and repeated login prompts, even on sites you know.

Also this week

Hannaford. The website and app were back October 20 after about a week offline. The company says it has no evidence customer data was taken. Stores stayed open. Expect fake "Hannaford account" emails and texts. Type the address yourself.

ConnectWise Cloud Backup (formerly SkyKick). Attackers used the backup service to reach customers' Microsoft 365 accounts. It signs in as an app, so a password and MFA do not stop it. ConnectWise shut it down October 17. If your business used it, call me.

Fake installers. Fake downloads posing as Claude, ChatGPT, Copilot and Gemini install password-stealing software. Get these only from the company's own site or your app store.

Nextcloud. If you run your own Nextcloud with the Collabora app, a critical flaw is being exploited. Update.

If something looks wrong on your computer, or you are not sure whether a site or email is real, reply and tell me what you see.

Mike
PCRescue | Portland, ME
Thirty-five years fixing computers, twenty-four of them running this shop.