Our Managed WordPress clients’ websites are patched, protected and showing no signs of compromise following this week’s advisory on the PHP2Shell vulnerability. Here is what happened, what we did, and how we keep your site safe going forward.

On October 21, 2026, the National Security Agency (NSA) issued an advisory urging organizations to patch a group of serious PHP vulnerabilities. PHP is the programming language that powers WordPress, so nearly every WordPress website on the internet runs on it. When a flaw is found in PHP itself, it affects sites across the board, no matter how well they are built.

What the NSA advisory said

The vulnerabilities, nicknamed “PHP2Shell,” could let an attacker take control of a web server without logging in or having any prior access. From there, attackers could steal data, take a site offline, or move deeper into a network.

The flaws sit in PHP itself, not in a website’s code or settings. That means any server running an affected PHP version is at risk until it is patched. The PHP project released its fix the same day as the advisory.

The NSA’s guidance for organizations was clear:

  • Apply the vendor patches for PHP2Shell as a top priority.
  • Take inventory of every service that relies on vulnerable PHP versions.
  • Add enhanced logging and keep a close eye on internet-facing systems in the weeks ahead.
  • Replace end-of-life PHP versions that cannot be patched.
  • Take a system offline if it cannot be updated right away.

You can read the full advisory on the NSA website.

What we did to protect your website from the PHP2Shell vulnerability

We had been monitoring these vulnerabilities closely and acted as soon as the notification came in. Our response happened in four steps:

  1. Applied security mitigations within hours. Our team put initial protections in place the same day we were notified.
  2. Updated PHP to a patched version. The next day, we moved client websites to a patched PHP release that closes the vulnerabilities at the source.
  3. Updated all plugins and themes. Every WordPress plugin and theme is up to date, so no older component leaves a back door open.
  4. Kept an extra layer of defense in front of every site. Our sites run behind WP Engine’s Global Edge Security (GES) network. Its advanced Web Application Firewall (WAF), threat detection and network-level protections help block malicious traffic before it ever reaches your website.

Where things stand now

All necessary updates and security mitigations have been applied, and we have no indication that any client website has been compromised. If you are a client, there is nothing you need to do.

How we keep your site safe going forward

We will keep watching for new advisories related to PHP2Shell and apply additional patches as soon as vendors release them. That work is part of our ongoing Managed WordPress website hosting and maintenance plans:

  • Monitoring security advisories from PHP, WordPress, our hosting partners and government agencies.
  • Keeping PHP, WordPress core, plugins and themes on current, supported versions.
  • Running every site behind WP Engine’s Global Edge Security for firewall and threat protection.
  • Maintaining daily backups for added safety

If you have questions about your website’s security, or your site is not yet on one of our maintenance plans, contact [email protected] and we will be glad to help.