New PHP flaws mean updating WordPress alone is not enough. Here are the simple steps a small business owner can take this week.
Two critical flaws in PHP, the software that runs underneath WordPress, were made public in October 2026, according to rainforest.tech. That means a fully updated WordPress site can still be at risk. This week, update WordPress, your plugins and your PHP version. Then turn on two-step login and test that your backups really work.
What changed this fall
WordPress is built with PHP. PHP is a programming language that runs on your web server. If PHP has a flaw, every site on that server can be affected, no matter how well the site is set up.
The two new flaws are named CVE-2026-109618 and CVE-2026-109619. Both are rated 9.8 on a common score that shows how serious a flaw is, says the same guide. They allow "unauthenticated remote code execution." In plain terms, someone who never logs in could run their own commands on your server. The guide's key point is simple. You have to patch PHP, not just WordPress.
Other things are current too:
- The official WordPress hardening guide was updated in October 2026. It says older versions of WordPress do not get security updates.
- The OWASP Foundation lists its Top 10 2025 as the most current version. This list names the most serious risks to web applications.
Where the risk really sits
Many owners assume their web host handles security. The WordPress guide says hosts are often responsible for the servers. They are not responsible for the software you choose to install. It also says hacks are rarely caused by the servers. They are most often caused by the site software itself.
Hosting setups differ. WordPress.com Support says it updates WordPress automatically, encrypts all sites and scans every site daily. It notes that at other WordPress hosts, the owner is typically responsible for setting up security. Ask your host which parts are yours.
Attacks are usually not personal. Automated tools scan the internet for sites with known weak plugins, says mytekrescue.com. Common ways in include:
- Weak or reused admin passwords
- Brute force attempts, where a program guesses passwords over and over
- Harmful file uploads through weak forms or plugins
- Hosting settings that are set up wrong
Rainforest.tech says plugins and themes are where most WordPress break-ins happen. It says the most common thread is how long it takes to patch.
Steps to take this week
- Update everything. Update WordPress, every plugin, every theme and your PHP version. Ask your host which PHP version you run and if it is patched.
- Turn on multi-factor login. Multi-factor authentication, or MFA, asks for two or more proofs of who you are, such as a password and a code. The Cybersecurity and Infrastructure Security Agency says MFA makes you 99% less likely to be hacked.
- Use long passwords. Mytekrescue.com says WordPress guidance suggests admin passwords of at least 20 characters. A password manager can store them for you.
- Test your backups. Make sure a backup actually restores, not just that it exists. A VMP Security guide covers the 3-2-1 rule, offsite storage and tested restores.
- Get plugins only from trusted places. The WordPress guide says to use the WordPress.org directory or well known companies. Remove plugins you no longer use.
- Check user accounts. Give each person only the access they need. Rainforest.tech lists accounts with too much access as a risk.
- Use HTTPS on every page. HTTPS is the lock that keeps data private between a visitor and your site. Mytekrescue.com says pages without it can expose logins on shared networks.
- Clean your own computer. The WordPress guide says no site security helps if your computer has a keylogger. A keylogger is hidden software that records what you type. Keep your browser up to date.
Keep it going
Security is not a one-time job. The WordPress guide calls it risk reduction, not risk elimination. Mytekrescue.com suggests a repeating calendar reminder to check your last backup and test a restore.
New flaws appear all the time. A simple routine helps: know what you run, patch it fast, keep access tight and watch for trouble. For free, plain guides, visit the NIST Small Business Cybersecurity Corner.
How I can help
AppWT is based in Livonia, Michigan. AppWT is practicing since 1997 and operating as AppWT since 2005. AppWT has built 600+ websites, by its own count. AppWT has a core team of 7. If you want help with the steps above, the service is Website Security Services, starting price $497.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- WordPress Security: A Practical Hardening Guide (2026), rainforest.tech, 2026-10-23
- Hardening WordPress: Advanced Administration Handbook | Developer.WordPress.org, WordPress Developer Resources, 2026-10-14
- OWASP Top 10 | OWASP Foundation, OWASP Foundation, 2025-11-20
- Keep Your WordPress Site Safe and Secure | WordPress.com Support, WordPress.com Support, 2011-03-14
- Harden WordPress in 30 and 90 Days: A Prioritized Plan for SMB Admins, mytekrescue.com, 2026-10-06
- Multifactor Authentication | Cybersecurity and Infrastructure Security Agency CISA, Cybersecurity and Infrastructure Security Agency
- WordPress Hardening Archives - VMP™ Security, vmpsecurity.com
- Small Business Cybersecurity Corner, National Institute of Standards and Technology, 2018-10-12
- Website Security Services at AppWT, AppWT
Tags
Frequently Asked Questions
If I update WordPress, am I safe from the new PHP flaws?
Not by itself. Rainforest.tech says a fully updated WordPress site on a weak PHP version is still exposed. Ask your host to confirm your PHP version is patched.
Does my web host handle security for me?
Only part of it. The WordPress guide says hosts often handle the servers but not the software you install. WordPress.com says it handles more security for sites it hosts.
How much does multi-factor login help?
CISA says using MFA makes you 99% less likely to be hacked. It works because a stolen password alone is not enough to log in.
How long should my admin password be?
Mytekrescue.com says WordPress guidance suggests at least 20 characters for admin passwords. A password manager makes long passwords easy to use.
Is having a backup enough?
You should also test that it restores. VMP Security covers offsite storage and tested restores as part of good backup habits.
Enjoyed this article?
Share it with your network
