The October 2026 PHP vulnerability: what it means for your WooCommerce store
On 21 October 2026, PHP released emergency fixes for two critical flaws that can let an attacker run code on a web server without logging in. Every WooCommerce store runs on PHP, so yours is affected until your host installs PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or a vendor's patched build). Updating WordPress or your plugins doesn't fix it. Check with your host today. Then ask whether you want to keep owning this job.
If you run a WooCommerce store, this week probably came with a worried email from your host, a security plugin warning, or a news headline about "70% of websites". Some of the panic is overblown, and some of it isn't. This guide sets out what actually happened, using the sources listed at the end, what to do about it right now, and what it says about running a store on WordPress in 2026.
I've built WordPress sites since 2016, and these days I move WooCommerce stores to Shopify for a living. So read the last part knowing that. The first two parts are useful whether you ever move or not.
What happened
PHP is the programming language WordPress and WooCommerce are written in. It runs on your hosting server and processes every page request. On 21 October 2026 the PHP project released fixes for two flaws, CVE-2026-109618 and CVE-2026-109619, both rated critical (9.2 out of 10). PHP says both can allow unauthenticated remote code execution, which means someone who has never logged in to your site could take control of the server.
- It's in PHP itself, not in a plugin. Patchstack put it plainly: "The flaws are in the PHP interpreter, not in any one application." WordPress, Drupal, Magento and Joomla sites are all exposed if they run an unpatched version.
- It reaches back a decade. Wiz Research, which found the flaws, says every PHP version back to 5.4 is affected by at least one of them, and demonstrated an attack against the latest WordPress container image.
- Details leaked before the fix. Information got out on 20 October, a day before the coordinated release. Cloudflare reported early attack traffic and switched on firewall rules before PHP's patch was out.
- Real exploitation, so far mostly probing. Krebs on Security reported that working exploits exist and the bugs are being exploited in the wild. As of the afternoon of 21 October, Patchstack's own data showed "only probing attacks" with "no hard evidence of breaches yet". Expect that to change as more sites are scanned.
- Some organisations went offline rather than risk it. Government and university sites in the Netherlands and Finland were taken down as a precaution, and CERT-EU and the UK's National Cyber Security Centre advised taking sites offline where they couldn't be protected immediately.
Wiz compared the situation to Log4Shell, the 2021 flaw that took years to clean up, because PHP is so widely installed. Censys counted about 2.58 million internet-facing servers running PHP.
What to do today if you're on WooCommerce
Don't wait for a migration to fix this. Patch first.
- Check your PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server. You need 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. Some Linux distributions patch without changing the version number, so if yours shows an older number, ask your host directly.
- Ask your host. Managed WordPress and shared hosts patch PHP for you, but on different schedules. Some had protections in place on day one; others asked customers to update PHP themselves. Get a written yes.
- On a VPS or your own server, nobody will patch it for you. Install the updated PHP packages and restart PHP so every worker runs the fixed version.
- On PHP 8.1 or older, upgrade. Those versions no longer get official updates. PHP published limited fixes for 7.4, 8.0 and 8.1 for people who build PHP themselves, but the real fix is moving to 8.2 or newer. Back up and test first, because old plugins and themes often break on newer PHP.
- Don't rely on a firewall alone. Cloudflare's rules help, but only if your server refuses traffic that doesn't come through Cloudflare. As Search Engine Journal put it, a firewall "is not a substitute for installing the fixes."
- Check for signs of a break-in after patching. "A patch does not remove an existing compromise." Look for unfamiliar admin users, PHP files you didn't add, and new plugins you didn't install. If you find any, treat the server as compromised and change every password and API key it holds, including your payment gateway keys.
- Avoid "fix" plugins and pasted code snippets from people you don't know. Patchstack warned against these specifically.
It isn't a one-off
A flaw in PHP itself is rare. Flaws in the plugins and services around a WooCommerce store are not. Here's what 2026 has looked like so far for store owners, just from the incidents that made the security news:
| When | What | Why it mattered to stores |
|---|---|---|
| May 2026 | Funnel Builder by FunnelKit, a checkout plugin on more than 40,000 WooCommerce stores | Sansec found attackers injecting fake Google Tag Manager code into checkout pages to steal card numbers, CVVs and billing addresses. FunnelKit patched it quickly and says 3 of about 1,300 sites it monitored showed signs of compromise. |
| June to August 2026 | Wholesale Lead Capture for WooCommerce, CVE-2026-27540, rated 9.8 | An unauthenticated file upload. Wordfence blocked more than 100,000 attempts to upload PHP backdoors, with attacks still arriving months after the fix. |
| September 2026 | WordPress core, CVE-2026-87902, fixed in 7.1.2 | A critical flaw in WordPress itself, present since 2016. No exploitation was reported, and sites with automatic updates were patched for them. |
| 18 to 19 October 2026 | UpdraftCentral, the remote dashboard for the UpdraftPlus backup plugin | Patchstack saw attackers holding valid connection keys install backdoor plugins that create a hidden account and skip two-factor login. On 19 October, Patchstack said no plugin update stopped it. Owners had to find and delete the keys by hand. |
| 21 October 2026 | PHP, CVE-2026-109618 and CVE-2026-109619 | The flaws in this guide. The fix is on your server, not in WordPress. |
The bigger picture comes from Patchstack's State of WordPress Security in 2026 report, covering 2025:
- 11,334 new vulnerabilities were found in the WordPress ecosystem, 42% more than the year before.
- 91% were in plugins and 9% in themes. WordPress core had only 6, all low priority.
- 46% had no fix from the developer by the time they were made public.
- For the most heavily attacked flaws, the typical time from disclosure to first attack was 5 hours.
WordPress core is well looked after. The risk is everything around it: the long list of plugins a typical store depends on, each from a different developer, plus the PHP version and server underneath. On a self-hosted store, keeping all of that patched within hours is your job, or your developer's, or your host's, and it's on you to check they did it.
What's different on Shopify
Shopify is a hosted platform. You don't have a server, a PHP version or a plugin folder, so there's nothing in this week's news for a Shopify merchant to patch. Shopify runs, monitors and updates the platform for every store at once.
| Who handles it | WooCommerce | Shopify |
|---|---|---|
| Server and PHP updates | You or your host | Shopify |
| Core software updates | You (or automatic, if switched on) | Shopify |
| Checkout and payment code | Your plugins, updated by you | Shopify |
| PCI DSS card security | Shared between you, your host and your payment provider | Shopify is certified Level 1 PCI DSS compliant, covering every store by default |
| Firewall and DDoS protection | Extra service or host add-on | Included |
| Apps or plugins you add | Your choice, your risk | Your choice, your risk |
| Staff logins and two-factor | You | You |
To be fair about it: Shopify isn't immune to security problems. Apps you install can still have flaws, and a weak staff password is still a weak password. Turn on two-factor login for every account, and keep your app list short. But the server, the language it runs on, the core software and the checkout are no longer yours to maintain. Every incident in the table above was in software a Shopify merchant doesn't install or run.
That's also why the hidden cost of WooCommerce isn't the hosting bill. It's the security plugin, the firewall, the developer on call, and the evening you spend reading about a PHP flaw instead of running your business.
If this was your last straw
Moving platforms isn't an emergency fix, and it shouldn't be rushed. Patch PHP first so your store is safe now. Then plan a migration on your own timeline, ideally away from your busiest season.
A careful move keeps everything you've built: every product, customer and order, your reviews, and your Google rankings, through a 301 redirect for every old URL. Your WooCommerce store keeps selling until the Shopify store is tested and approved. These guides cover the details:
Questions
Will updating WordPress or WooCommerce fix the PHP flaw?
No. PHP runs on your hosting server, separately from WordPress. Only a PHP update from your host, or from you if you manage the server, fixes it. WordPress.org has said no WordPress update is needed for these flaws.
Is my store hacked?
Not necessarily. Exploitation started before the fix, but early reports showed mostly probing. After your host confirms the patch, check for unfamiliar admin users, new plugins and PHP files you didn't add. If you find anything, restore from a clean backup and change every password and key the site holds.
Does Shopify use PHP?
Shopify's core platform is built on Ruby on Rails, not PHP. More to the point, it isn't something you host or update, so PHP versions and server patches aren't part of running a Shopify store. Shopify maintains the platform for every merchant.
Is Shopify completely secure?
No platform is. Shopify handles the hosting, platform, checkout and PCI compliance, which removes most of the work in this guide. You still choose your apps and protect your staff accounts, so use two-factor login and only install apps you need.
Should I migrate now, in the middle of this?
Patch first. A migration takes a few weeks to do properly, so it's a fix for next year's incidents, not this week's. If you're already thinking about leaving, this is a good time to get a quote and plan the move outside your busiest season.
Sources
- Patchstack, Major security alert: PHP vulnerable to critical RCE, attacks ongoing (21 October 2026)
- Krebs on Security, Widespread PHP flaw may cause many site outages today (21 October 2026)
- Search Engine Journal, Critical PHP core security flaws affect websites, including WordPress (updated 22 October 2026)
- Codeable, PHP security release on 21 October 2026: what WordPress site owners need to do
- Patchstack, UpdraftCentral key compromise (19 October 2026)
- The Hacker News, Funnel Builder flaw exploited to enable WooCommerce checkout skimming (May 2026)
- SOCRadar, CVE-2026-27540 WooCommerce flaw exploited (September 2026)
- BetaNews, Update to WordPress 7.1.2 to fix a critical security flaw (September 2026)
- Patchstack, State of WordPress Security in 2026
- Shopify, PCI compliant hosting
This guide was accurate on the date above. Security news moves quickly, so check your host's status page and the PHP project for the latest fixes.