Critical vulnerabilities discovered in PHP put 70% of all websites worldwide at risk

By:  
Published:

On October 21, 2026, two critical vulnerabilities were announced in PHP, affecting more than 70% of all websites worldwide, including WordPress and all other major content management systems.

Rated 9.2 out of 10, both vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered by AI and allow attackers to execute malicious code remotely without authentication, potentially compromising entire websites and servers.

Multiple incidents have already been reported, and more are expected in the upcoming weeks. As a preventive solution, several government and financial institutions have temporarily limited access to their resources while applying the critical security patch.

The security patch is already available and must be applied immediately. The PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

While this is not a WPBakery vulnerability, websites with WPBakery running vulnerable PHP versions may be exposed.

How to protect your websites

To protect your WordPress website from these PHP vulnerabilities, it is important to take immediate action. Follow these simple steps to keep your website secure and up to date:

  1. Create a backup: Before making any updates, create a complete backup of your website, including files and the database.
  2. Update PHP immediately: Update PHP to a patched version or contact your hosting provider or web agency to perform the update as soon as possible.
  3. Update WordPress: Make sure your WordPress installation is running the latest version to maintain compatibility with updated PHP versions.
  4. Update themes and plugins: Update all installed themes and plugins, including WPBakery, to their latest versions to ensure security and compatibility.

WPBakery automatic updates are available to direct license owners with an active support period or Support Plus subscription. All direct license owners can also download the latest version manually from the WPBakery Customer Center.

For users who received WPBakery in a theme, you can get a direct license from the official website.

Further steps

At WPBakery, we take security seriously. Security is an integral part of our development process, and we continuously review our releases for potential vulnerabilities. We also collaborate with Patchstack as part of our security workflow to identify and address potential threats.

Our commitment goes beyond securing WPBakery itself. We believe it is equally important to keep our customers informed about security incidents that may affect their websites, even when those incidents are not directly related to our product.

As an additional security measure, starting with WPBakery 9.1, scheduled for release in October 2026, we will raise the minimum supported PHP version to 8.2.35. This change will help encourage the adoption of more secure PHP versions and ensure that WPBakery remains compatible with updated server environments.

We remain committed to continuously improving WPBakery’s security and helping our customers keep their websites safe, secure, and up to date.

Raitis Sevelis
Product leader with 10+ years driving strategic growth for B2B and B2C solutions, including Head of Product at WPBakery Page Builder for WordPress. Raitis holds deep expertise in e-commerce, digital marketing, UX, AI, and scaling organizational teams. Active educator, speaker, and community contributor with a strong presence in IT and WordPress spaces as well as lecturer at Riga Nordic University.

Leave a Reply