{"id":2023952,"date":"2026-10-22T14:11:20","date_gmt":"2026-10-22T14:11:20","guid":{"rendered":"https:\/\/wpx.net\/blog\/?p=2023952"},"modified":"2026-10-22T14:57:59","modified_gmt":"2026-10-22T14:57:59","slug":"two-critical-php-flaws-every-wpx-server-patched-in-90-minutes","status":"publish","type":"post","link":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/","title":{"rendered":"Two critical PHP flaws. Every WPX server patched in 90 minutes."},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">On 21 October, PHP shipped fixes for two critical vulnerabilities that allow remote code execution on almost any PHP website. Here is what we did, when we did it, and why WPX customers never had to lift a finger.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_case_in_short\"><\/span><strong>The case in short:&nbsp;<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The threat: 2 critical PHP vulnerabilities &#8211; CVE-2026-109618 and CVE-2026-109619 &#8211; both rated 9.2 out of 10, and both allow unauthenticated remote code execution.<\/li>\n\n\n\n<li>Before the fix existed: our admins had hardening rules live on every server, on every PHP version.<\/li>\n\n\n\n<li>After the fix shipped: We started rolling them out at 17:30. By 19:00, every server was patched.<\/li>\n\n\n\n<li>Old PHP versions: every site still running PHP older than 7.4 was moved to patched PHP 7.4. No WPX site runs anything older today.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_happened_in_detail\"><\/span><strong>What happened in detail:&nbsp;<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP runs most of the web, WordPress included. On 20 October 2026, the PHP project announced an upcoming security release. On 21 October, it shipped fixes for two flaws serious enough that <a href=\"https:\/\/cert.europa.eu\/publications\/security-advisories\/2026-018\/\">CERT-EU<\/a>, the EU&#8217;s cybersecurity response team, issued a critical advisory the same day.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2026-109618 sits in how PHP handles running out of memory mid-request, for example during a file upload. Memory that was never properly set up gets cleaned up anyway, and it can contain attacker-controlled data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2026-109619 lets leftover state from one crashed request leak into the next request handled by the same PHP worker. The confirmed attack paths run through PHP&#8217;s session upload progress feature.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The short version: an attacker with no login could run their own code on the server. CERT-EU reported that proof-of-concept exploits were already circulating.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_execution_timeline\"><\/span><strong>The execution timeline:&nbsp;<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">All times are Sofia time (EEST) on 21 October 2026, unless noted.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Time (EEST)<\/strong><\/td><td><strong>What happened<\/strong><\/td><\/tr><tr><td>21 Oct<\/td><td>The PHP project announces an upcoming security release.<br>Our admin team picks it up through security channels.<\/td><\/tr><tr><td>By 12:00<\/td><td>Hardening rules live on every WPX server, for every PHP version and every site.<\/td><\/tr><tr><td>17:30<\/td><td>We start rolling out the official patched PHP builds.<\/td><\/tr><tr><td>19:00<\/td><td>Every server running PHP 7.4 or newer is patched. Temporary rules removed. Everything back to normal. In parallel, a few remaining sites on PHP older than 7.4 were moved to patched PHP 7.4.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>From the official fix to every server patched: 90 minutes.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_we_did_step_by_step\"><\/span><strong>What we did, step by step<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>We heard early: <\/strong>Our admin team picked up the advance notice through security channels as soon as the PHP project flagged it, before the technical details went public. The goal with any vulnerability is simple: have defenses in place before attackers know where to look.<\/li>\n\n\n\n<li><strong>We hardened every server before a patch existed. <\/strong><strong><br><\/strong>Two changes went live across all PHP versions and all sites. First, we switched off PHP&#8217;s session upload progress feature, the same mitigation CERT-EU recommends for CVE-2026-109619. Second, we added a Web Application Firewall rule that challenges upload requests with a CAPTCHA. That stops most automated attack scripts cold.&nbsp;<\/li>\n\n\n\n<li><strong>Then we checked our own stack. <\/strong><strong><br><\/strong>WPX runs on LiteSpeed web servers with LSPHP. Our engineers assessed that the attack paths, as disclosed, did not apply to our published setup. We kept the hardening on anyway. &#8220;Probably not affected&#8221; is not a security policy.<\/li>\n\n\n\n<li><strong>We installed the official patches the moment they landed. <\/strong><strong><br><\/strong>We started at 17:30. By 19:00, every server running PHP 7.4 or newer was on a patched build. In parallel, a small number of sites were still running PHP versions older than 7.4. We upgraded every one of them to a patched PHP 7.4. Today, no site on WPX runs anything older.<\/li>\n\n\n\n<li><strong>We put everything back. <\/strong><strong><br><\/strong>With the real fix in place, the temporary rules had done their job. Then we removed them so uploads, forms, and everything else returned to exactly how they worked before.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_trade-off_we_made\"><\/span><strong>The trade-off we made<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For a few hours on 21 October, some uploads on WPX sites asked for a CAPTCHA, and a few upload features behaved differently. That was us. It was deliberate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A short inconvenience beat leaving a door open while the patch was on its way. Once we installed the official fix, we removed the rules, and everything went back to normal. If you noticed it, now you know why.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_you_need_to_do\"><\/span><strong>What you need to do<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your site is hosted with WPX, then nothing. The patches are installed, the temporary rules are gone, and your site runs exactly as it did before.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you run sites anywhere else, check your PHP by asking your host which version it is and if it\u2019s patched.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_this_is_our_job_not_yours\"><\/span><strong>Why this is our job, not yours<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A critical vulnerability is a race. The riskiest window is the one between the details going public and the patch reaching your server. On WPX, we closed that window before it opened, then installed the real fix within hours of its release.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">While our admins worked on the servers, our support team answered every chat and ticket in real time. Real people, not a chatbot, as always.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The only thing our customers noticed was the result.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><picture><source type=\"image\/webp\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/for-blog-article-472x1024.png.webp\"><img data-slip-wrapped=\"1\" loading=\"lazy\" decoding=\"async\" width=\"472\" height=\"1024\" src=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/for-blog-article-472x1024.png\" alt=\"Victor Perez and Daniel Stanica on Facebook, 22 October 2026.\" class=\"wp-image-2023953\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/for-blog-article-472x1024.png 472w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/for-blog-article-138x300.png 138w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/for-blog-article-768x1665.png 768w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/for-blog-article-709x1536.png 709w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/for-blog-article-945x2048.png 945w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/for-blog-article.png 1179w\" sizes=\"auto, (max-width: 472px) 100vw, 472px\" \/><\/picture><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Victor Perez and Daniel Stanica on Facebook, 22 October 2026.<\/em><\/p>\n\n\n\n<div class=\"wp-block-stackable-image stk-block-image stk-block stk-9e2feb7\" data-block-id=\"9e2feb7\"><figure><span class=\"stk-img-wrapper stk-image--shape-stretch\"><picture><source type=\"image\/webp\" media=\"(max-width: 480px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle1-480w.png.webp\"><source type=\"image\/webp\" media=\"(max-width: 768px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle1-768w.png.webp\"><source type=\"image\/webp\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle1.png.webp\"><source media=\"(max-width: 480px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle1-480w.png\"><source media=\"(max-width: 768px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle1-768w.png\"><img data-slip-wrapped=\"1\" loading=\"lazy\" decoding=\"async\" class=\"stk-img wp-image-2023954\" src=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle1.png\" width=\"886\" height=\"685\" alt=\"WPX customer, on Live chat, 21 October 2026.\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle1.png 886w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle1-300x232.png 300w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle1-768x594.png 768w\" sizes=\"auto, (max-width: 886px) 100vw, 886px\" \/><\/picture><\/span><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><br><em>WPX customer, on Live chat, 21 October 2026.<\/em><\/p>\n\n\n\n<div class=\"wp-block-stackable-image stk-block-image stk-block stk-3487c47\" data-block-id=\"3487c47\"><figure><span class=\"stk-img-wrapper stk-image--shape-stretch\"><picture><source type=\"image\/webp\" media=\"(max-width: 480px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle3-480w.png.webp\"><source type=\"image\/webp\" media=\"(max-width: 768px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle3-768w.png.webp\"><source type=\"image\/webp\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle3.png.webp\"><source media=\"(max-width: 480px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle3-480w.png\"><source media=\"(max-width: 768px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle3-768w.png\"><img data-slip-wrapped=\"1\" loading=\"lazy\" decoding=\"async\" class=\"stk-img wp-image-2023955\" src=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle3.png\" width=\"892\" height=\"630\" alt=\"WPX customer, on Live chat, 21 October 2026.\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle3.png 892w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle3-300x212.png 300w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle3-768x542.png 768w\" sizes=\"auto, (max-width: 892px) 100vw, 892px\" \/><\/picture><\/span><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><br><em>WPX customer on Live chat, 21 October 2026.<br><\/em><\/p>\n\n\n\n<div class=\"wp-block-stackable-image stk-block-image stk-block stk-763a450\" data-block-id=\"763a450\"><figure><span class=\"stk-img-wrapper stk-image--shape-stretch\"><picture><source type=\"image\/webp\" media=\"(max-width: 480px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle4-480w.png.webp\"><source type=\"image\/webp\" media=\"(max-width: 768px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle4-768w.png.webp\"><source type=\"image\/webp\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle4.png.webp\"><source media=\"(max-width: 480px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle4-480w.png\"><source media=\"(max-width: 768px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle4-768w.png\"><img data-slip-wrapped=\"1\" loading=\"lazy\" decoding=\"async\" class=\"stk-img wp-image-2023956\" src=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle4.png\" width=\"907\" height=\"717\" alt=\"WPX customer, on Live chat, 21 October 2026.\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle4.png 907w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle4-300x237.png 300w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle4-768x607.png 768w\" sizes=\"auto, (max-width: 907px) 100vw, 907px\" \/><\/picture><\/span><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><em>WPX customer on Live chat, 21 October 2026.<\/em><\/p>\n\n\n\n<div class=\"wp-block-stackable-image stk-block-image stk-block stk-652c30a\" data-block-id=\"652c30a\"><figure><span class=\"stk-img-wrapper stk-image--shape-stretch stk--has-lightbox\"><picture><source type=\"image\/webp\" media=\"(max-width: 480px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle2-480w.png.webp\"><source type=\"image\/webp\" media=\"(max-width: 768px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle2-768w.png.webp\"><source type=\"image\/webp\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle2.png.webp\"><source media=\"(max-width: 480px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle2-480w.png\"><source media=\"(max-width: 768px)\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle2-768w.png\"><img data-slip-wrapped=\"1\" loading=\"lazy\" decoding=\"async\" class=\"stk-img wp-image-2023957\" src=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle2.png\" width=\"907\" height=\"544\" alt=\"WPX customer, on Live chat, 21 October 2026.\" srcset=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle2.png 907w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle2-300x180.png 300w, https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/forblogarticle2-768x461.png 768w\" sizes=\"auto, (max-width: 907px) 100vw, 907px\" \/><\/picture><\/span><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><em>WPX customer on Live chat, 21 October 2026.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That is what managed WordPress hosting should mean. You run your business. We watch the servers.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Not on WPX yet?<a href=\"https:\/\/wpx.net\/cart\/wordpress-hosting\/\"> See our plans<\/a> and let our team move your sites over for you.<\/p>\n\n\n\n<div class=\"wp-block-group is-layout-constrained wp-block-group-is-layout-constrained\">\n<div class=\"wp-block-stackable-columns stk-block-columns stk-block stk-d92e0ac\" data-block-id=\"d92e0ac\"><div class=\"stk-row stk-inner-blocks stk-block-content stk-content-align stk-d92e0ac-column\">\n<div class=\"wp-block-stackable-column stk-block-column stk-column stk-block stk-26f1be8\" data-v=\"4\" data-block-id=\"26f1be8\"><div class=\"stk-column-wrapper stk-block-column__content stk-container stk-26f1be8-container stk--no-background stk--no-padding\"><div class=\"stk-block-content stk-inner-blocks stk-26f1be8-inner-blocks\">\n<div class=\"wp-block-stackable-columns stk-block-columns stk-block stk-eb2a2e9\" data-block-id=\"eb2a2e9\"><div class=\"stk-row stk-inner-blocks stk-block-content stk-content-align stk-eb2a2e9-column\">\n<div class=\"wp-block-stackable-column stk-block-column stk-column stk-block stk-6b69f57\" data-v=\"4\" data-block-id=\"6b69f57\"><div class=\"stk-column-wrapper stk-block-column__content stk-container stk-6b69f57-container stk--no-background stk--no-padding\"><div class=\"stk-block-content stk-inner-blocks stk-6b69f57-inner-blocks\">\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Frequently_Asked_Questions\"><\/span>Frequently Asked Questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Have another question?<\/strong><\/p>\n\n\n\n<div class=\"wp-block-getwid-button-group\"><div class=\"wp-block-getwid-button-group__wrapper\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link has-background wp-element-button\" style=\"border-radius:100px;background-color:#fb5718;padding-top:var(--wp--preset--spacing--20);padding-right:var(--wp--preset--spacing--30);padding-bottom:var(--wp--preset--spacing--20);padding-left:var(--wp--preset--spacing--30)\">Chat with us  <\/a><\/div>\n\n\n\n<div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link has-white-background-color has-text-color has-background has-link-color has-border-color wp-element-button\" style=\"border-color:#fb5718;border-style:solid;border-width:1px;border-radius:100px;color:#fb5718;padding-top:var(--wp--preset--spacing--20);padding-right:var(--wp--preset--spacing--30);padding-bottom:var(--wp--preset--spacing--20);padding-left:var(--wp--preset--spacing--30)\">Knowledge<\/a><\/div>\n<\/div><\/div>\n<\/div><\/div><\/div>\n<\/div><\/div>\n<\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-stackable-column stk-block-column stk-column stk-block stk-570ede2\" data-v=\"4\" data-block-id=\"570ede2\"><style>.stk-570ede2-container{margin-top:8px !important;margin-right:8px !important;margin-bottom:8px !important;margin-left:8px !important;}.stk-570ede2-inner-blocks{row-gap:0px !important;}<\/style><div class=\"stk-column-wrapper stk-block-column__content stk-container stk-570ede2-container stk--no-background stk--no-padding\"><div class=\"stk-block-content stk-inner-blocks stk-570ede2-inner-blocks\">\n<details class=\"wp-block-stackable-accordion stk-block-accordion stk-inner-blocks stk-block-content stk--single-open stk-block stk-5440b9d is-style-plain\" data-block-id=\"5440b9d\"><style>.stk-5440b9d {border-style:solid !important;border-color:#ff6900 !important;border-top-width:1px !important;border-right-width:0px !important;border-bottom-width:1px !important;border-left-width:0px !important;padding-bottom:0px !important;margin-bottom:0px !important;top:0px !important;}<\/style><style class=\"stk-custom-css\">.stk-5440b9d.stk-block-accordion{border-top:solid 1px #f9f9f9 !important;border-bottom:solid 1px #f9f9f9 !important}.stk-5440b9d.stk-block-accordion:hover{border-top:solid 1px #FB5718 !important;border-bottom:solid 1px #FB5718 !important;z-index:2 !important}.stk-5440b9d.stk-block-accordion .stk-block-heading__text:hover{color:#FB5718 !important}<\/style>\n<summary class=\"wp-block-stackable-column stk-block-column stk-column stk-block stk-9826665 stk--container-small stk-block-accordion__heading\" data-v=\"4\" data-block-id=\"9826665\"><style>.stk-9826665-container{margin-top:0px !important;margin-right:0px !important;margin-bottom:0px !important;margin-left:0px !important;}.stk-9826665 {margin-top:10px !important;margin-bottom:10px !important;}<\/style><div class=\"stk-column-wrapper stk-block-column__content stk-container stk-9826665-container stk--no-background stk--no-padding\"><div class=\"stk-block-content stk-inner-blocks stk-9826665-inner-blocks\">\n<div class=\"wp-block-stackable-icon-label stk-block-icon-label stk-block stk-f731768\" data-block-id=\"f731768\"><div class=\"stk-row stk-inner-blocks stk-block-content\">\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-1d07f29\" id=\"strong-strong-do-i-need-to-update-anything-on-my-wpx-site-strong-strong\" data-block-id=\"1d07f29\"><style>.stk-1d07f29 .stk-block-heading__text{font-size:14px !important;font-weight:bold !important;font-family:\"Montserrat\", Sans-serif !important;}@media screen and (max-width:999px){.stk-1d07f29 .stk-block-heading__text{font-size:14px !important;}}<\/style><p class=\"stk-block-heading__text\"><strong><strong>Do I need to update anything on my WPX site?<\/strong><\/strong><\/p><\/div>\n\n\n\n<div class=\"wp-block-stackable-icon stk-block-icon stk-block stk-09f46f5\" data-block-id=\"09f46f5\"><style>.stk-09f46f5 .stk--svg-wrapper .stk--inner-svg svg:last-child, .stk-09f46f5 .stk--svg-wrapper .stk--inner-svg svg:last-child :is(g, path, rect, polygon, ellipse){fill:#fb5718 !important;}<\/style><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg style=\"height:0;width:0\"><defs><linearGradient id=\"linear-gradient-09f46f5\" x1=\"0\" x2=\"100%\" y1=\"0\" y2=\"0\"><stop offset=\"0%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-09-f-46-f-5-color-1)\"><\/stop><stop offset=\"100%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-09-f-46-f-5-color-2)\"><\/stop><\/linearGradient><\/defs><\/svg><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 320 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M313.553 392.331L209.587 504.334c-9.485 10.214-25.676 10.229-35.174 0L70.438 392.331C56.232 377.031 67.062 352 88.025 352H152V80H68.024a11.996 11.996 0 0 1-8.485-3.515l-56-56C-4.021 12.926 1.333 0 12.024 0H208c13.255 0 24 10.745 24 24v328h63.966c20.878 0 31.851 24.969 17.587 40.331z\"\/><\/svg><\/div><\/span><\/div>\n<\/div><\/div>\n<\/div><\/div><\/summary>\n\n\n\n<div class=\"wp-block-stackable-column stk-block-column stk-column stk-block stk-cbe30ae stk-block-accordion__content\" data-v=\"4\" data-block-id=\"cbe30ae\"><style>.stk-cbe30ae-container{margin-top:0px !important;margin-right:0px !important;margin-bottom:5px !important;margin-left:0px !important;padding-top:0px !important;padding-right:0px !important;padding-bottom:0px !important;padding-left:0px !important;}.stk-cbe30ae {margin-bottom:10px !important;}<\/style><div class=\"stk-column-wrapper stk-block-column__content stk-container stk-cbe30ae-container stk--no-background stk--no-padding\"><div class=\"stk-block-content stk-inner-blocks stk-cbe30ae-inner-blocks\">\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-4308034\" data-block-id=\"4308034\"><style>.stk-4308034 {column-count:1 !important;padding-bottom:0px !important;}.stk-4308034 .stk-block-text__text{font-size:12px !important;}@media screen and (max-width:999px){.stk-4308034 .stk-block-text__text{font-size:12px !important;}}<\/style><p class=\"stk-block-text__text has-text-align-left\">No. We patched PHP on every server. You don&#8217;t need to install, switch, or configure anything.<\/p><\/div>\n<\/div><\/div><\/div>\n<\/details>\n\n\n\n<details class=\"wp-block-stackable-accordion stk-block-accordion stk-inner-blocks stk-block-content stk--single-open stk-block stk-161f507 is-style-plain\" data-block-id=\"161f507\"><style>.stk-161f507 {border-style:solid !important;border-color:#ff6900 !important;border-top-width:1px !important;border-right-width:0px !important;border-bottom-width:1px !important;border-left-width:0px !important;padding-bottom:0px !important;margin-bottom:0px !important;top:-1px !important;z-index:1 !important;}<\/style><style class=\"stk-custom-css\">.stk-161f507.stk-block-accordion{border-top:solid 1px #f9f9f9 !important;border-bottom:solid 1px #f9f9f9 !important}.stk-161f507.stk-block-accordion:hover{border-top:solid 1px #FB5718 !important;border-bottom:solid 1px #FB5718 !important;z-index:2 !important}.stk-161f507.stk-block-accordion .stk-block-heading__text:hover{color:#FB5718 !important}<\/style>\n<summary class=\"wp-block-stackable-column stk-block-column stk-column stk-block stk-7553d5d stk--container-small stk-block-accordion__heading\" data-v=\"4\" data-block-id=\"7553d5d\"><style>.stk-7553d5d-container{margin-top:0px !important;margin-right:0px !important;margin-bottom:0px !important;margin-left:0px !important;}.stk-7553d5d {margin-top:10px !important;margin-bottom:10px !important;}<\/style><div class=\"stk-column-wrapper stk-block-column__content stk-container stk-7553d5d-container stk--no-background stk--no-padding\"><div class=\"stk-block-content stk-inner-blocks stk-7553d5d-inner-blocks\">\n<div class=\"wp-block-stackable-icon-label stk-block-icon-label stk-block stk-bbe1134\" data-block-id=\"bbe1134\"><div class=\"stk-row stk-inner-blocks stk-block-content\">\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-f601dd1\" id=\"strong-was-my-website-at-risk-strong\" data-block-id=\"f601dd1\"><style>.stk-f601dd1 .stk-block-heading__text{font-size:14px !important;font-weight:bold !important;font-family:\"Montserrat\", Sans-serif !important;}@media screen and (max-width:999px){.stk-f601dd1 .stk-block-heading__text{font-size:14px !important;}}<\/style><p class=\"stk-block-heading__text\"><strong>Was my website at risk? <\/strong><\/p><\/div>\n\n\n\n<div class=\"wp-block-stackable-icon stk-block-icon stk-block stk-dd584a4\" data-block-id=\"dd584a4\"><style>.stk-dd584a4 .stk--svg-wrapper .stk--inner-svg svg:last-child, .stk-dd584a4 .stk--svg-wrapper .stk--inner-svg svg:last-child :is(g, path, rect, polygon, ellipse){fill:#fb5718 !important;}<\/style><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg style=\"height:0;width:0\"><defs><linearGradient id=\"linear-gradient-dd584a4\" x1=\"0\" x2=\"100%\" y1=\"0\" y2=\"0\"><stop offset=\"0%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-dd-584-a-4-color-1)\"><\/stop><stop offset=\"100%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-dd-584-a-4-color-2)\"><\/stop><\/linearGradient><\/defs><\/svg><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 320 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M313.553 392.331L209.587 504.334c-9.485 10.214-25.676 10.229-35.174 0L70.438 392.331C56.232 377.031 67.062 352 88.025 352H152V80H68.024a11.996 11.996 0 0 1-8.485-3.515l-56-56C-4.021 12.926 1.333 0 12.024 0H208c13.255 0 24 10.745 24 24v328h63.966c20.878 0 31.851 24.969 17.587 40.331z\"\/><\/svg><\/div><\/span><\/div>\n<\/div><\/div>\n<\/div><\/div><\/summary>\n\n\n\n<div class=\"wp-block-stackable-column stk-block-column stk-column stk-block stk-70c732a stk-block-accordion__content\" data-v=\"4\" data-block-id=\"70c732a\"><style>.stk-70c732a-container{margin-top:0px !important;margin-right:0px !important;margin-bottom:0px !important;margin-left:0px !important;padding-top:0px !important;padding-right:0px !important;padding-bottom:0px !important;padding-left:0px !important;}.stk-70c732a {margin-bottom:10px !important;}<\/style><div class=\"stk-column-wrapper stk-block-column__content stk-container stk-70c732a-container stk--no-background stk--no-padding\"><div class=\"stk-block-content stk-inner-blocks stk-70c732a-inner-blocks\">\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-9c503ff\" data-block-id=\"9c503ff\"><style>.stk-9c503ff {column-count:1 !important;padding-bottom:0px !important;}.stk-9c503ff .stk-block-text__text{font-size:12px !important;}@media screen and (max-width:999px){.stk-9c503ff .stk-block-text__text{font-size:12px !important;}}<\/style><p class=\"stk-block-text__text has-text-align-left\">Hardening rules were active on every server before the official fix was released, and our engineers assessed that the disclosed attack paths did not apply to our LiteSpeed and LSPHP setup as published. If anything on your site looks unusual, contact support and we will check it with you.<\/p><\/div>\n<\/div><\/div><\/div>\n<\/details>\n\n\n\n<details class=\"wp-block-stackable-accordion stk-block-accordion stk-inner-blocks stk-block-content stk--single-open stk-block stk-120aa3f is-style-plain\" data-block-id=\"120aa3f\"><style>.stk-120aa3f {border-style:solid !important;border-color:#ff6900 !important;border-top-width:1px !important;border-right-width:0px !important;border-bottom-width:1px !important;border-left-width:0px !important;padding-bottom:0px !important;margin-bottom:0px !important;top:-2px !important;z-index:1 !important;}<\/style><style class=\"stk-custom-css\">.stk-120aa3f.stk-block-accordion{border-top:solid 1px #f9f9f9 !important;border-bottom:solid 1px #f9f9f9 !important}.stk-120aa3f.stk-block-accordion:hover{border-top:solid 1px #FB5718 !important;border-bottom:solid 1px #FB5718 !important;z-index:2 !important}.stk-120aa3f.stk-block-accordion .stk-block-heading__text:hover{color:#FB5718 !important}<\/style>\n<summary class=\"wp-block-stackable-column stk-block-column stk-column stk-block stk-01730bb stk--container-small stk-block-accordion__heading\" data-v=\"4\" data-block-id=\"01730bb\"><style>.stk-01730bb-container{margin-top:0px !important;margin-right:0px !important;margin-bottom:0px !important;margin-left:0px !important;}.stk-01730bb {margin-top:10px !important;margin-bottom:10px !important;}<\/style><div class=\"stk-column-wrapper stk-block-column__content stk-container stk-01730bb-container stk--no-background stk--no-padding\"><div class=\"stk-block-content stk-inner-blocks stk-01730bb-inner-blocks\">\n<div class=\"wp-block-stackable-icon-label stk-block-icon-label stk-block stk-34f665c\" data-block-id=\"34f665c\"><div class=\"stk-row stk-inner-blocks stk-block-content\">\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-bb711a3\" id=\"strong-my-site-was-on-a-php-version-older-than-7-4-and-it-was-upgraded-what-now-strong\" data-block-id=\"bb711a3\"><style>.stk-bb711a3 .stk-block-heading__text{font-size:14px !important;font-weight:bold !important;font-family:\"Montserrat\", Sans-serif !important;}@media screen and (max-width:999px){.stk-bb711a3 .stk-block-heading__text{font-size:14px !important;}}<\/style><p class=\"stk-block-heading__text\"><strong>My site was on a PHP version older than 7.4, and it was upgraded. What now?<\/strong><\/p><\/div>\n\n\n\n<div class=\"wp-block-stackable-icon stk-block-icon stk-block stk-9a1b057\" data-block-id=\"9a1b057\"><style>.stk-9a1b057 .stk--svg-wrapper .stk--inner-svg svg:last-child, .stk-9a1b057 .stk--svg-wrapper .stk--inner-svg svg:last-child :is(g, path, rect, polygon, ellipse){fill:#fb5718 !important;}<\/style><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg style=\"height:0;width:0\"><defs><linearGradient id=\"linear-gradient-9a1b057\" x1=\"0\" x2=\"100%\" y1=\"0\" y2=\"0\"><stop offset=\"0%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-9-a-1-b-057-color-1)\"><\/stop><stop offset=\"100%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-9-a-1-b-057-color-2)\"><\/stop><\/linearGradient><\/defs><\/svg><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 320 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M313.553 392.331L209.587 504.334c-9.485 10.214-25.676 10.229-35.174 0L70.438 392.331C56.232 377.031 67.062 352 88.025 352H152V80H68.024a11.996 11.996 0 0 1-8.485-3.515l-56-56C-4.021 12.926 1.333 0 12.024 0H208c13.255 0 24 10.745 24 24v328h63.966c20.878 0 31.851 24.969 17.587 40.331z\"\/><\/svg><\/div><\/span><\/div>\n<\/div><\/div>\n<\/div><\/div><\/summary>\n\n\n\n<div class=\"wp-block-stackable-column stk-block-column stk-column stk-block stk-e63cb15 stk-block-accordion__content\" data-v=\"4\" data-block-id=\"e63cb15\"><style>.stk-e63cb15-container{margin-top:0px !important;margin-right:0px !important;margin-bottom:5px !important;margin-left:0px !important;padding-top:0px !important;padding-right:0px !important;padding-bottom:0px !important;padding-left:0px !important;}.stk-e63cb15 {margin-bottom:10px !important;}<\/style><div class=\"stk-column-wrapper stk-block-column__content stk-container stk-e63cb15-container stk--no-background stk--no-padding\"><div class=\"stk-block-content stk-inner-blocks stk-e63cb15-inner-blocks\">\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-4672aac\" data-block-id=\"4672aac\"><style>.stk-4672aac {column-count:1 !important;padding-bottom:0px !important;}.stk-4672aac .stk-block-text__text{font-size:12px !important;}@media screen and (max-width:999px){.stk-4672aac .stk-block-text__text{font-size:12px !important;}}<\/style><p class=\"stk-block-text__text has-text-align-left\"><strong> <\/strong>Check that everything works as expected. If something looks off, our support team will sort it out with you.<\/p><\/div>\n<\/div><\/div><\/div>\n<\/details>\n<\/div><\/div><\/div>\n<\/div><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>On 21 October, PHP shipped fixes for two critical vulnerabilities that allow remote code execution on almost any PHP website. Here is what we did, when we did it, and why WPX customers never had to lift a finger. The case in short:&nbsp; What happened in detail:&nbsp; PHP runs most of the web, WordPress included. [&hellip;]<\/p>\n","protected":false},"author":12,"featured_media":2023959,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"cybocfi_hide_featured_image":"","footnotes":"","_ppma_block_editor_authors":"{\"authors\":[104],\"author_categories\":{\"104\":\"1\"},\"fallback_author_user\":\"14\",\"ppma_author_box_select\":\"\",\"selected_authors\":[{\"id\":104,\"display_name\":\"Emanuel Serafimov\",\"is_guest\":0,\"category_id\":\"1\"}]}"},"categories":[89,102],"tags":[],"ppma_author":[104],"class_list":["post-2023952","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-the-wpx-way"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Two critical PHP flaws. Every WPX server patched in 90 minutes. - WPX Blog: World&#039;s Fastest WordPress Host<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Two critical PHP flaws. Every WPX server patched in 90 minutes. - WPX Blog: World&#039;s Fastest WordPress Host\" \/>\n<meta property=\"og:description\" content=\"On 21 October, PHP shipped fixes for two critical vulnerabilities that allow remote code execution on almost any PHP website. Here is what we did, when we did it, and why WPX customers never had to lift a finger. The case in short:&nbsp; What happened in detail:&nbsp; PHP runs most of the web, WordPress included. [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/\" \/>\n<meta property=\"og:site_name\" content=\"WPX Blog: World&#039;s Fastest WordPress Host\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-22T14:11:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-22T14:57:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/Two-critical-PHP-flaws.-Every-WPX-server-patched-in-90-minutes_.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Emanuel Serafimov\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Emanuel Serafimov\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/\"},\"author\":{\"name\":\"Emanuel Serafimov\",\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/#\\\/schema\\\/person\\\/1b106006be540ebf8764700df5b52bca\"},\"headline\":\"Two critical PHP flaws. Every WPX server patched in 90 minutes.\",\"datePublished\":\"2026-10-22T14:11:20+00:00\",\"dateModified\":\"2026-10-22T14:57:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/\"},\"wordCount\":1013,\"publisher\":{\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/wpx.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Two-critical-PHP-flaws.-Every-WPX-server-patched-in-90-minutes_.png\",\"articleSection\":[\"Security\",\"The WPX Way\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/\",\"url\":\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/\",\"name\":\"Two critical PHP flaws. Every WPX server patched in 90 minutes. - WPX Blog: World&#039;s Fastest WordPress Host\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/wpx.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Two-critical-PHP-flaws.-Every-WPX-server-patched-in-90-minutes_.png\",\"datePublished\":\"2026-10-22T14:11:20+00:00\",\"dateModified\":\"2026-10-22T14:57:59+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/#primaryimage\",\"url\":\"https:\\\/\\\/wpx.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Two-critical-PHP-flaws.-Every-WPX-server-patched-in-90-minutes_.png\",\"contentUrl\":\"https:\\\/\\\/wpx.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Two-critical-PHP-flaws.-Every-WPX-server-patched-in-90-minutes_.png\",\"width\":1280,\"height\":720,\"caption\":\"Two critical PHP flaws. Every WPX server patched in 90 minutes.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/wpx.net\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Two critical PHP flaws. Every WPX server patched in 90 minutes.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/wpx.net\\\/blog\\\/\",\"name\":\"WPX Blog: World&#039;s Fastest WordPress Host\",\"description\":\"Get The Latest WordPress Guides, Tips, And Tricks. Learn How You Can Grow Your Online Business and How WPX Can Help You With That.\",\"publisher\":{\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/wpx.net\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/#organization\",\"name\":\"WPX Blog: World&#039;s Fastest WordPress Host\",\"url\":\"https:\\\/\\\/wpx.net\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/wpx.net\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/04\\\/Logo-2.png\",\"contentUrl\":\"https:\\\/\\\/wpx.net\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/04\\\/Logo-2.png\",\"width\":3049,\"height\":833,\"caption\":\"WPX Blog: World&#039;s Fastest WordPress Host\"},\"image\":{\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/wpx.net\\\/blog\\\/#\\\/schema\\\/person\\\/1b106006be540ebf8764700df5b52bca\",\"name\":\"Emanuel Serafimov\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/90c67eff7e97c738c7ee1771dffbb1b341b27601f28e5ca9348052e0ab030bec?s=96&d=mm&r=g183036681715168b7c1beded97146205\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/90c67eff7e97c738c7ee1771dffbb1b341b27601f28e5ca9348052e0ab030bec?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/90c67eff7e97c738c7ee1771dffbb1b341b27601f28e5ca9348052e0ab030bec?s=96&d=mm&r=g\",\"caption\":\"Emanuel Serafimov\"},\"description\":\"We take pride in WPX's Support and are even prouder that Emanuel stands behind the training of all new Technical Support Team members. Passionate about technology and innovations, he works tirelessly in introducing our team to all that's new to WordPress and WordPress hosting.\",\"url\":\"https:\\\/\\\/wpx.net\\\/blog\\\/author\\\/emanuel-serafimov\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Two critical PHP flaws. Every WPX server patched in 90 minutes. - WPX Blog: World&#039;s Fastest WordPress Host","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/","og_locale":"en_US","og_type":"article","og_title":"Two critical PHP flaws. Every WPX server patched in 90 minutes. - WPX Blog: World&#039;s Fastest WordPress Host","og_description":"On 21 October, PHP shipped fixes for two critical vulnerabilities that allow remote code execution on almost any PHP website. Here is what we did, when we did it, and why WPX customers never had to lift a finger. The case in short:&nbsp; What happened in detail:&nbsp; PHP runs most of the web, WordPress included. [&hellip;]","og_url":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/","og_site_name":"WPX Blog: World&#039;s Fastest WordPress Host","article_published_time":"2026-10-22T14:11:20+00:00","article_modified_time":"2026-10-22T14:57:59+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/Two-critical-PHP-flaws.-Every-WPX-server-patched-in-90-minutes_.png","type":"image\/png"}],"author":"Emanuel Serafimov","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Emanuel Serafimov","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/#article","isPartOf":{"@id":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/"},"author":{"name":"Emanuel Serafimov","@id":"https:\/\/wpx.net\/blog\/#\/schema\/person\/1b106006be540ebf8764700df5b52bca"},"headline":"Two critical PHP flaws. Every WPX server patched in 90 minutes.","datePublished":"2026-10-22T14:11:20+00:00","dateModified":"2026-10-22T14:57:59+00:00","mainEntityOfPage":{"@id":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/"},"wordCount":1013,"publisher":{"@id":"https:\/\/wpx.net\/blog\/#organization"},"image":{"@id":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/#primaryimage"},"thumbnailUrl":"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/Two-critical-PHP-flaws.-Every-WPX-server-patched-in-90-minutes_.png","articleSection":["Security","The WPX Way"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/","url":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/","name":"Two critical PHP flaws. Every WPX server patched in 90 minutes. - WPX Blog: World&#039;s Fastest WordPress Host","isPartOf":{"@id":"https:\/\/wpx.net\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/#primaryimage"},"image":{"@id":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/#primaryimage"},"thumbnailUrl":"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/Two-critical-PHP-flaws.-Every-WPX-server-patched-in-90-minutes_.png","datePublished":"2026-10-22T14:11:20+00:00","dateModified":"2026-10-22T14:57:59+00:00","breadcrumb":{"@id":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/#primaryimage","url":"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/Two-critical-PHP-flaws.-Every-WPX-server-patched-in-90-minutes_.png","contentUrl":"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2026\/10\/Two-critical-PHP-flaws.-Every-WPX-server-patched-in-90-minutes_.png","width":1280,"height":720,"caption":"Two critical PHP flaws. Every WPX server patched in 90 minutes."},{"@type":"BreadcrumbList","@id":"https:\/\/wpx.net\/blog\/two-critical-php-flaws-every-wpx-server-patched-in-90-minutes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/wpx.net\/blog\/"},{"@type":"ListItem","position":2,"name":"Two critical PHP flaws. Every WPX server patched in 90 minutes."}]},{"@type":"WebSite","@id":"https:\/\/wpx.net\/blog\/#website","url":"https:\/\/wpx.net\/blog\/","name":"WPX Blog: World&#039;s Fastest WordPress Host","description":"Get The Latest WordPress Guides, Tips, And Tricks. Learn How You Can Grow Your Online Business and How WPX Can Help You With That.","publisher":{"@id":"https:\/\/wpx.net\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/wpx.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/wpx.net\/blog\/#organization","name":"WPX Blog: World&#039;s Fastest WordPress Host","url":"https:\/\/wpx.net\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/wpx.net\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2021\/04\/Logo-2.png","contentUrl":"https:\/\/wpx.net\/blog\/wp-content\/uploads\/2021\/04\/Logo-2.png","width":3049,"height":833,"caption":"WPX Blog: World&#039;s Fastest WordPress Host"},"image":{"@id":"https:\/\/wpx.net\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/wpx.net\/blog\/#\/schema\/person\/1b106006be540ebf8764700df5b52bca","name":"Emanuel Serafimov","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/90c67eff7e97c738c7ee1771dffbb1b341b27601f28e5ca9348052e0ab030bec?s=96&d=mm&r=g183036681715168b7c1beded97146205","url":"https:\/\/secure.gravatar.com\/avatar\/90c67eff7e97c738c7ee1771dffbb1b341b27601f28e5ca9348052e0ab030bec?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/90c67eff7e97c738c7ee1771dffbb1b341b27601f28e5ca9348052e0ab030bec?s=96&d=mm&r=g","caption":"Emanuel Serafimov"},"description":"We take pride in WPX's Support and are even prouder that Emanuel stands behind the training of all new Technical Support Team members. Passionate about technology and innovations, he works tirelessly in introducing our team to all that's new to WordPress and WordPress hosting.","url":"https:\/\/wpx.net\/blog\/author\/emanuel-serafimov\/"}]}},"authors":[{"term_id":104,"user_id":12,"is_guest":0,"slug":"emanuel-serafimov","display_name":"Emanuel Serafimov","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/90c67eff7e97c738c7ee1771dffbb1b341b27601f28e5ca9348052e0ab030bec?s=96&d=mm&r=g","author_category":"1","user_url":"","last_name":"Serafimov","first_name":"Emanuel","job_title":"","description":"We take pride in WPX's Support and are even prouder that Emanuel stands behind the training of all new Technical Support Team members. Passionate about technology and innovations, he works tirelessly in introducing our team to all that's new to WordPress and WordPress hosting."}],"_links":{"self":[{"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/posts\/2023952","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/comments?post=2023952"}],"version-history":[{"count":3,"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/posts\/2023952\/revisions"}],"predecessor-version":[{"id":2023961,"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/posts\/2023952\/revisions\/2023961"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/media\/2023959"}],"wp:attachment":[{"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/media?parent=2023952"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/categories?post=2023952"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/tags?post=2023952"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/wpx.net\/blog\/wp-json\/wp\/v2\/ppma_author?post=2023952"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}