A WordPress security alert is making small business owners ask an urgent question: could someone break into my website?
Wiz Research reported critical flaws in PHP, the software that runs WordPress and other platforms. Its researchers demonstrated attacks that could run code on vulnerable WordPress servers without signing in. PHP also released security fixes on October 21, 2026.
That is serious. It does not mean every WordPress website has been hacked. Your immediate risk depends on the PHP version and configuration your host runs, and whether the fixes have been installed. Ask your hosting provider to confirm your site is patched.
What happened?
Wiz calls the findings PHP2Shell. The flaws are in PHP’s core engine, below WordPress itself. The report describes two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Wiz demonstrated remote code execution on WordPress, Drupal and Joomla systems running affected PHP versions. It also showed that vulnerable PHP processes could expose information in memory, such as passwords, access tokens or API keys.
For a business owner, the practical point is simple: updating WordPress, a plugin or a theme does not by itself confirm that the PHP software on the server is fixed. That part is managed by your web host.
What should I do right now?
Contact your hosting company and ask:
- Which PHP version is serving my website?
- Has the security update for CVE-2026-109618 and CVE-2026-109619 been installed on my site?
- Were affected PHP workers restarted or replaced as part of the update?
- If the update is not complete, what protection is in place and when will the patch be installed?
Keep their reply. If you suspect someone accessed your site, ask the host to preserve and review the relevant logs. Avoid making changes that could erase evidence, and get qualified incident-response help if customer information or site access may have been exposed.
Does this mean every WordPress site is hacked?
No. Wiz’s report describes serious vulnerabilities and successful demonstrations on affected, unpatched PHP systems. It does not establish that every WordPress site has been attacked or that every site is still vulnerable today. A host may already have installed the fixes. Confirm the status of your own site rather than guessing from the headline.
WordPress has been around for many years and runs on PHP. Like other widely used software, it needs ongoing security updates. New issues can appear in the platform, its plugins, themes or server software. Regular maintenance and a hosting provider that applies updates promptly remain essential.
Want to move your website off WordPress?
Patching is the first step if you keep your current WordPress site. If you would rather move away from WordPress and PHP, wingz can recreate your business website and host the replacement.
For a straightforward business website, a low-cost rebuild can often be completed in less than a day after we review its pages, forms, integrations and domain setup. We confirm the scope, price and timing before work begins. Online stores and sites with custom systems need a closer assessment.
We build the replacement for you to review before the domain is switched. Keep the current site and its security updates in place until you approve the new one and the cutover is ready. A Wingz-hosted rebuild moves the website pages off the WordPress/PHP setup involved in this alert. Hosting and software still need security maintenance, and no platform can promise that a website will never face another security issue.
Ask wingz for a WordPress website transfer review. Send us your website address and the features you need to keep. We’ll tell you whether a same-day rebuild is realistic and confirm the cost before we start.