On Wednesday, October 21, 2026, a good part of the web spent the day patching a security hole. Two critical vulnerabilities had been discovered in PHP, the language that runs WordPress and a large share of the world’s websites. As a precaution, governments took some of their websites offline, including in Canada.
If your website runs on WordPress, you were affected. If it’s on Framer, you had nothing to do. Here’s why, in simple terms, and what you need to check if your site still runs on WordPress.
In short: the vulnerability is in PHP itself, not in WordPress. Every site that runs PHP on its server had to be updated, and that fix depends on your host. Framer sites don’t use PHP: Framer confirmed the same day that they were not affected.
What happened
On the evening of October 20, the PHP team warned that an urgent security update would come out the next day. On October 21, it released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two vulnerabilities rated 9.2 out of 10 (CVE-2026-109618 and CVE-2026-109619). They were nicknamed “PHP2Shell” and let an attacker run their own code on a server, without needing a password.
The scale comes from the fact that PHP is everywhere. According to researchers at Wiz, every version of PHP released over the past ten years is affected by at least one of the two vulnerabilities.
The Canadian Centre for Cyber Security issued an alert the same day. The federal government took some of its websites offline as a precaution, and so did Newfoundland and Labrador. In Europe, ministries and public administrations did the same while waiting for the fix. Hosting providers reported the first attack attempts as early as October 21.
Why WordPress was on the front line
WordPress is written in PHP. Every time a visitor opens a page, the server runs PHP code to build it. With about 4 in 10 websites worldwide according to W3Techs, WordPress was the biggest target.
The most confusing part for site owners: updating WordPress did nothing. The vulnerability is in PHP, underneath WordPress. The fix had to come from whoever manages the server, which in most cases means your host. So a perfectly up-to-date WordPress site could still be exposed.
Another problem: old versions. PHP 8.1 and earlier no longer receive official fixes, and according to W3Techs, more than a third of PHP sites still run on PHP 7 or PHP 5. For them, the host has to apply an adapted fix, or the site has to migrate to a supported version.
Why Framer sites had nothing to do
The same day, Framer announced that Framer and the sites it hosts were not affected by this vulnerability, and that no action was needed.
The reason is simple: a Framer site doesn’t run PHP. You design your pages in the editor, Framer prepares them for publishing and serves them to your visitors from its own hosting. There’s no PHP server under your site, so there’s nothing to patch when a vulnerability like this one appears.
That doesn’t make a Framer site invulnerable. Security then depends on Framer’s platform and on your account, which needs to stay protected by a strong password. But a whole category of risk disappears: no plugins to update, no PHP version to monitor, no host to chase down on a crisis night.
Is your website on WordPress? Four checks to do this week
Find out your PHP version. In your WordPress dashboard, open Tools, then Site Health, Info tab, Server section.
Ask your host whether they’ve applied the fix. The safe versions are 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. On older versions, some hosts apply an adapted fix without changing the version number: ask them in writing.
Plan an upgrade if you’re on PHP 8.1 or earlier. These versions no longer get official fixes. Now is the time to move to a supported version, testing your plugins first.
Watch for signs of intrusion. An administrator account you don’t recognize, strange redirects, unknown files or repeated 500 errors should raise a red flag. When in doubt, change your passwords, including your hosting ones.
If you don’t know who manages your site’s PHP, that’s the first thing to find out: the day a vulnerability like this comes out, that’s the person who has to act.
Should you leave WordPress over this?
Not necessarily. WordPress is still a good choice for a large store, a complex members’ area or a site with hundreds of articles, as long as someone takes care of the updates and the server.
For a service business website, like a coach’s, a therapist’s or a consultant’s, the question is different: do you want to manage a server? If the answer is no, Framer takes that work off your plate. I go into more detail in my Framer vs WordPress comparison.
Thinking of switching to Framer? Start by seeing what your site could look like: get your free mockup.
Sources
[ Got a project in mind? ]
See your future website.
Answer a few questions: if your project is selected, you receive the mockup of your homepage within 3 business days. No commitment.
