PHP security fix: what local WordPress site owners should know

Local businesses, clubs and community groups that run WordPress websites are being urged to make sure their sites use updated software after the PHP project released fixes for two security flaws on Wednesday, Oct. 21.

PHP is the programming language that WordPress and many other websites run on.

In a security advisory on its website, the PHP project said versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 "fix two critical vulnerabilities that can allow unauthenticated remote code execution." It added: "All PHP users are strongly encouraged to update immediately."

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated critical in the U.S. National Vulnerability Database, which lists a score of 9.8 out of 10. The PHP project's own rating, using a newer scoring system, is 9.2.

The PHP project said PHP 8.1 and older no longer receive updates from the project, and advised users of those versions to contact their vendor or upgrade to a supported version.

EasyWP sites in partial read-only mode

Web host Namecheap said Wednesday it was "taking emergency measures" for all websites on its EasyWP managed WordPress hosting.

As part of that work, the company said it enabled a feature called HackGuardian, which "puts websites in partial read-only mode, limiting changes to website files and content." While it is on, customers cannot install new themes or plugins, and it "has been enabled globally and cannot be disabled by individual customers," Namecheap said.

The company said it would move EasyWP websites to the new PHP version once the updated PHP image is available. Its maintenance window began at 10 a.m. Eastern time. It was first scheduled to end at 1 p.m., but Namecheap extended it and gave a new expected end time of 3 p.m.

What site owners can do

• Check your host's notices. Most website owners don't manage PHP themselves. Look for status or maintenance posts from your hosting company.
• Make sure PHP is updated. If your host lets you choose a PHP version, pick a supported one that includes the fix. If you aren't sure, ask your host or web developer.
• Keep a backup. Make sure you have a recent copy of your site that you can restore.
• Update WordPress, themes and plugins when your host allows changes again.

Disclosure: The Banner's publisher operates a business whose website is hosted on EasyWP.