Get Started 
Dear Customer,
Yesterday was a tough day for much of the internet with the leaked embargoed announcement of two critical CVEs affecting PHP – CVE-2026-109618 and CVE-2026-109619. Both of these vulnerabilities required every web host running PHP, including WP Engine, to apply PHP patches immediately upon release.
Importantly, our customers do not need to take any action. As a managed hosting provider, WP Engine worked around the clock to protect our customers’ sites, first by implementing proactive mitigation and then by applying the patch upon its release. All customer sites are running fully patched versions of PHP.
We recognize that most of our customers have business-critical sites, which is why they have invested in managed hosting. You, as a customer, shouldn’t have to think about security. Now that the dust has settled after successfully patching all of our infrastructure, I have had time to reflect on how we at WP Engine can better communicate with our customers. We realize not all of our customers received relevant and regular status updates, and we want to make sure that you know the steps we are taking to protect you. We are discussing this with our teams and are committing to improve communication processes moving forward.
To that end, it is important to provide more details about what WP Engine did specifically to protect your websites hosted on our platforms.
Shortly after midnight US Central Time on October 21, based on information we have been following and had received about the vulnerabilities, our Security Team immediately enabled the latest Web Application Firewall (WAF) rules to detect and block potentially malicious requests to customers on the WP Engine and Flywheel platforms.
Additionally, by 3:00 AM US Central Time on October 21, we deployed the recommended mitigations to our PHP configuration across all platforms while we waited for official patches to start rolling them out in order to fully protect customers from the risk of disclosed CVEs.
As soon as we received official patches from our enterprise PHP Long-Term Support (LTS) provider, we began testing them and deploying to our platforms, patching all customer sites. While the updated PHP versions were being deployed across the platforms, the mitigations we had deployed in the morning hours yesterday provided a level of protection for every customer.
We did not feel comfortable stating that customers were fully protected until we were able to fully apply the official PHP patches to all customer sites.
Our teams continue to actively monitor traffic and network requests to ensure no attempted exploits were successful. Over the past 24 hours, our managed WAF rules blocked more than one million requests associated with these PHP vulnerabilities, and we have seen no successful exploit attempts.
We value each one of our customers and your feedback. If you have any questions, we are here to help. Thank you for trusting us with your business!
Sincerely,
Slade Cozart
VP, Customer Experience
