Critical PHP Security Flaw Affects WordPress Sites

Your website is the engine behind every lead you get. Every ad click, every Google search, every referral ends up there. So when the NSA issues a warning about the software powering that site, you don’t file it away for later. You deal with it today.

Here’s the short version: the NSA just warned about two critical security vulnerabilities in PHP, the software that powers WordPress. A huge number of local service business websites run on WordPress, so there’s a real chance this one lands on your desk.

These are not minor bugs. They’re rated 9.2 out of 10 in severity, and under certain conditions they could let hackers into your website without ever knowing your password. Security fixes have already been released – but there’s a catch, and most business owners are going to miss it. Let’s break it down.

The NSA Warning, in Plain English

Quick tech lesson, no jargon. PHP is the software WordPress runs on. It’s the engine under the hood – you never see it, but every page on your site depends on it. When two critical vulnerabilities show up in PHP, every WordPress site sitting on an unpatched server is exposed.

A 9.2 out of 10 severity rating is about as bad as these scores get. And here’s the detail that should grab your attention: under certain conditions, an attacker doesn’t even need your password. Your password is the lock on your front door. This is a broken window nobody told you about.

Why Updating WordPress Won’t Save You

This is the trap. Every WordPress owner has been trained the same way: log in, update the core, update the plugins, done. Site’s “maintained.”

Not this time. The hole isn’t in WordPress itself. It’s not in your plugins or your theme. It’s in PHP – and PHP lives on your hosting company’s server, not inside your WordPress dashboard. You can update everything on your screen and still be completely exposed.

The good news: the security fixes are already out. The only question is whether your host has actually applied them to your account. Which brings us to what’s at stake if they haven’t.

What Hackers Can Do If Your Site Is Vulnerable

This isn’t theoretical. If your site is exposed, here’s what’s on the table:

• Steal your customer information. Every form fill on your site – names, phone numbers, addresses, project details – is data a hacker could walk away with.
• Redirect your visitors to scam websites. A homeowner clicks your ad or finds you on Google, lands on your site, and gets bounced to a scam page. You paid for that visit. The customer blames you.
• Inject spam into your pages. Spammy content showing up on your pages that you never put there – trashing what your visitors see when they check you out.
• Take control of your entire website. Full takeover. Your site, your content, your customer data – in someone else’s hands.

This Isn’t an IT Problem. It’s a Marketing Problem.

I talk to contractors every week who treat their website like a brochure – something that just sits there and looks pretty. Wrong. Your website is the hub of your entire marketing operation. Every dollar you spend on Google Ads, every bit of local SEO effort, every Facebook campaign – all of it funnels people to that one site.

So when that site goes down, starts redirecting homeowners to scam pages, or gets stuffed with spam, you don’t have a tech headache. You have a lead generation problem. Your ad spend keeps running. Your competitors keep booking jobs. And if customer information gets stolen, the trust you’ve spent years building in your market takes the hit.

Plenty of owners hand all of this to a home service marketing agency and assume someone is handling it. Maybe. But the company running your ads is not automatically the company managing your hosting. This kind of gap lives exactly between vendors – the agency thinks the developer has it, the developer thinks the host has it, and meanwhile nobody checks. This is why I push owners inside Local Service Mastery to actually own their marketing assets: know who hosts your site, who maintains it, and who picks up the phone when something breaks.

How to Protect Your Website, Step by Step

1. Contact your hosting company today

The fixes exist. Your host just needs to apply them. Reach out and ask one direct question: “Has PHP been updated with the latest security fixes on my account?” Don’t settle for a vague “your site is fine.” You want confirmation that PHP itself was updated – because, again, updating WordPress or your plugins does not touch this.

2. Have a web developer? Send them this

If a developer manages your website for you, don’t wait. Send them this video right now and let them handle it. This is a quick conversation for someone who knows what they’re doing – but only if they know about it.

3. Want to check it yourself? Use this exact prompt

If you use Claude Code, copy the prompt below, paste it in, and it will walk you through checking and fixing your site step by step. If a developer manages your website, forward this prompt to them as is.

My WordPress website may be exposed to two critical PHP security vulnerabilities announced on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619, see php.net; the NSA also warned about them). Help me check and fix this safely. Do not change anything else on my site.

1. Find out which PHP version my website runs. Open my WordPress dashboard (Tools > Site Health > Info > Server), or my hosting control panel's PHP settings. Tell me the exact version.
2. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older in those lines is vulnerable, and PHP 8.1 or older will never receive this fix.
3. Before changing anything, make sure a fresh backup of my site exists (hosting panel backup or a backup plugin). Show me where it is.
4. If my host lets me choose the PHP version (cPanel "Select PHP Version", SiteGround "PHP Manager", Hostinger, GoDaddy, Bluehost and so on), switch my site to PHP 8.3 or 8.4, the newest one offered. Do it step by step in my browser and tell me each click.
5. After switching, check that my homepage, a few inner pages, my contact form and my wp-admin login all load with no errors. If anything breaks, switch back to the previous version immediately and tell me what broke.
6. Write a short support message I can send my hosting company asking them to confirm the server runs the patched PHP build for CVE-2026-109618 and CVE-2026-109619 (8.3.36 / 8.4.27 or their backport), and until it does, to set session.upload_progress.enabled = 0 in the server's PHP configuration.
7. Finish with a one-paragraph summary: version before, version after, what you changed, what the host still needs to confirm.

Quick tip: if your site runs PHP 8.1 or older, that’s the urgent one. Those versions will never get this fix.

One last thing – share this with a fellow business owner. If their site runs on WordPress, they’re in the same boat, and most of them have no idea. A two-second share could save somebody’s entire online presence.

Two critical PHP vulnerabilities. A 9.2 out of 10 severity rating. An NSA warning behind all of it. If your website runs on WordPress, this is your problem until your hosting company confirms PHP has been updated – because no amount of WordPress or plugin updates will patch it.

The bigger lesson goes well past this one fix. Your website is where every lead you pay for ends up. Whether you run your own marketing or hire a home services marketing company to run it for you, nobody protects that asset unless somebody asks the hard questions. One call to your host today is the difference between business as usual and a hijacked site torching the reputation you spent years building.

Inside Local Service Mastery, this is the ownership mindset we drill into every contractor and service business owner we coach: your website, your ads, your data – your responsibility. Make the call. Check the patch. Then share this with a fellow owner before their site becomes the next cautionary tale.