Two critical flaws in PHP let attackers take over websites without logging in. PHP has released fixes, and sites on our managed hosting platform are already patched. Standard Lovable apps do not use PHP and are not affected.
What happened
On 21 October 2026, PHP released fixes for two critical flaws (CVE-2026-109618 and CVE-2026-109619) that researchers at Wiz named “PHP2Shell”. PHP is the programming language that runs WordPress and many other websites.
- What an attacker can do: take full control of a website’s server remotely, with no password and no plugin involved.
- Severity: PHP rates both flaws 9.2 out of 10 (CVSS v4.0).
- Who is exposed: almost every PHP version from 5.4 onward. Updating WordPress, themes or plugins does not fix it, because the flaw is in PHP itself.
- Current threat: Cloudflare reports early attacks, and exploit code is circulating online.
Are you affected?
Find your setup below. If you are unsure which one applies, contact us and we will check for you.
| Your setup | Risk | Why |
|---|---|---|
| WordPress on a VPS, cPanel or self-managed server | High | You or your provider must update PHP. Nothing is patched until that happens. |
| WordPress on PHP 8.1 or older | High | These versions are end-of-life and get no official fix. An upgrade to PHP 8.2 or newer is required. |
| WordPress on managed hosting (e.g. WP Engine, Kinsta, WordPress.com) | Medium until confirmed | Most managed hosts patch PHP for you. Confirm your host has moved to a fixed version. |
| Lovable app (standard setup) | Not affected | Lovable apps are built on React and Supabase and do not run PHP. |
| Lovable app connected to a PHP backend (e.g. a WordPress or WooCommerce API, Laravel) | High for the backend | The Lovable app is fine, but the PHP server it talks to is exposed. |
| Lovable app hosted on a shared PHP host (e.g. cPanel) | Low to medium | Your app’s pages are static, but other PHP sites on the same server can be attacked. |
What we are doing
Sites on our managed hosting platform are patched. Our hosting provider has applied the PHP security fix across its platform, and we have verified the patched version is running on the client sites we checked. While the fix rolled out, firewall protections blocked attempts to exploit the flaws, and our provider reports no evidence of any breaches.
- Done: PHP patched on our managed hosting platform, for both live and staging sites.
- Done: firewall protections in place to block known attack attempts.
- In progress: confirming the patch with other hosting providers for client sites hosted elsewhere.
- In progress: security scans to confirm there are no signs of compromise.
If you host with us, there’s nothing you need to do. We will contact you directly if your site needs any further action.
What you should do
WordPress customers
- Check your PHP version. In WordPress, go to Tools → Site Health → Info → Server.
- Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer. On managed hosting, ask your host to confirm the fixed version in writing.
- If you are on PHP 8.1 or older, plan an upgrade to PHP 8.2 or newer now. Test on a staging copy first if you can, but don’t wait to take steps 4 and 5.
- Turn on firewall protection while you upgrade. Cloudflare’s protection is on by default, including on the free plan, but only for traffic routed through Cloudflare.
- Limit access to sites you can’t patch quickly. Use maintenance mode, a password, or an IP allow-list until the upgrade is done.
- Don’t run “test” scripts found online to check your site. Some contain malware.
Updating WordPress, themes or plugins alone does not fix this. Keep them updated, but the PHP upgrade is what closes the hole.
Lovable customers
- Standard Lovable app: no action needed.
- Your app calls a PHP backend (WordPress, WooCommerce, Laravel or a custom PHP API): follow the WordPress steps above for that server.
- Your app is hosted on a shared PHP host: ask your host to confirm PHP is patched, or contact us about moving it.
Warning signs to report
Contact us right away if you notice any of these, especially before your site was patched:
- Your site shows frequent “500” or “critical error” pages
- New administrator accounts you didn’t create
- Unfamiliar files, especially
.phpfiles inwp-content/uploads - Unexpected redirects, pop-ups or spam pages on your site
- A warning from your host, Google or your browser that the site is unsafe
Contact us: support@exceeddev.com · (407) 530-3980 · Monday to Friday, 8 AM to 5 PM Eastern