Yesterday was a tough day for much of the internet with the announcement of two critical CVEs affecting PHP.
All WP Engine customer sites are running fully patched versions of PHP. Over the past 24 hours, our managed WAF rules blocked more than one million requests associated with these PHP vulnerabilities, and we have seen no successful exploit attempts. Our teams continue to actively monitor traffic and network requests to ensure no attempted exploits were successful.
We realize that not all of our customers received relevant and regular status updates. To understand and learn more about what we did specifically to protect your sites, read our blog here: wpengine.com/blog/php-vulne…
All WP Engine customer sites are running fully patched versions of PHP. Over the past 24 hours, our managed WAF rules blocked more than one million requests associated with these PHP vulnerabilities, and we have seen no successful exploit attempts. Our teams continue to actively monitor traffic and network requests to ensure no attempted exploits were successful.
We realize that not all of our customers received relevant and regular status updates. To understand and learn more about what we did specifically to protect your sites, read our blog here: wpengine.com/blog/php-vulne…
wpengine.com Two critical CVEs affecting PHP | WP Engine® Yesterday was a tough day for much of the internet with the leaked embargoed announcement of two critical CVEs affecting PHP - CVE-2026-109618 and CVE-2026-109619. 
