The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.
It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)
Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5
Seriously though, how quickly do you expect patches to be available for WordPress? I’ve got one WordPress site that I made years ago for a friend’s business. I pop in on it and update stuff every few months.
Should I take it down?
it’s PHP that needs the patches. Yes you should take the site down until PHP has been patched.
edit: assuming you are hosting wordpress yourself. if you’re using a large 3rd party service that manages PHP itself like wordpress themselves, one should hope that they will be updating PHP early, before the patch is even released publicly.
Yeah it’s self hosted, thanks
depends. do you want to deal with a simple patch in 24 hours or do you want to rebuild an entire legacy system from nothing (assuming you don’t take proper backups)?
How dare you (correctly) assume I haven’t taken proper backups!
Jk lol
I do have a couple backups I made a few months ago. Never tested restoring them, so I don’t count them as “real”.
I’m hosting on namecheap servers, using their cpanel and stuff. So I don’t have the option of installing my own PHP version, just selecting theirs.
But apparently they had some mitigations in place before updating, and then they got us updated.