--- title: "Two WordPress security scares in one week. Check your site today." description: "A critical PHP flaw and a hacked UpdraftPlus backup plugin hit WordPress sites in October 2026. What happened and exactly what to check." url: https://dumbcmo.com/blog/wordpress-php-and-updraftplus-security-scares category: "The big picture" tags: ["news", "wordpress", "security", "website"] published: 2026-10-26 updated: 2026-10-26 reading_time: 4 min author: "The DumbCMO" --- # Two WordPress security scares in one week. Check your site today. > **TL;DR:** Two things hit WordPress sites on 19 to 21 October 2026: critical PHP flaws that need your host to update, and UpdraftPlus connection keys that let attackers add admins. Update, check your users, then check your plugins. [Notebook](https://dumbcmo.com) › [Blog](https://dumbcmo.com/blog) › The big picture › Two WordPress security scares in one week. Check your site today. Your shop has a lock, and a second lock, and a night guard. Then you find out the building’s main gate has been broken for a week, and the guard’s spare keys were stolen. That’s roughly what happened to WordPress sites this week. Nobody needs to panic. Everybody needs to check. ## In normal-people words Search Engine Journal reported two separate problems. **1. PHP.** PHP is the language WordPress runs on, on your hosting server. On 21 October 2026 PHP released emergency fixes for two critical flaws that **could let attackers run code on a web server without logging in**. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get regular support. **2. UpdraftPlus.** UpdraftPlus is a backup plugin on more than 3 million sites. TeamUpdraft’s own website was compromised on 17 and 18 October and attackers got hold of UpdraftCentral connection keys. They used them to install malicious plugins and create admin accounts on connected sites, bypassing logins and two-factor. Fixed versions came out on 19 October: **1.26.13 (free) and 2.26.13 (premium)**. > **The DumbCMO:** A backup plugin that gets hacked is a security guard who sells your house keys. Go check the d#mn locks. ## Check these two things **Which one is yours?** - **If** You have a WordPress site on shared hosting **→ then** Ask your host if PHP is on a fixed version. Updating WordPress or plugins does not update PHP. - **If** You use UpdraftPlus **→ then** Update to 1.26.13 or 2.26.13 or newer, then check for strange plugins and admin users. Only sites connected to UpdraftCentral Cloud were hit, but some backup-only users may be connected without knowing. - **If** You use neither **→ then** Still ask your host about PHP. Everyone with WordPress runs it. ## The chai stall version Your stall has a shutter and a padlock. This week, the padlock maker announced a flaw and a thief copied some spare keys. **New padlock is step one. Checking nothing was taken is step two.** ## Why this matters for Google too A hacked site can show spam pages, redirect visitors or get flagged as unsafe, and then your rankings suffer. Google also reminded site owners that if your site is down for patching, serve a 503 (“come back soon”) response rather than letting it break, so it doesn’t drop out of search. ## Do this today - [ ] In WordPress, go to Tools, Site Health, Info, Server and note your PHP version. If it’s older than the fixed versions, message your host today. - [ ] Update UpdraftPlus if you have it. In its settings, remove any UpdraftCentral keys you don’t recognise. - [ ] Open Users and look for admins you don’t know. Delete them and change every admin password. - [ ] Open Plugins and look for names you didn’t install. One reported fake was called “Site Health Cache”. - [ ] Don’t have a recent backup from before 17 October? Make one now and keep it somewhere that isn’t your site. ## Not-so-frequently asked questions ### Updating the patch didn't remove the backdoor. Why? A patch closes the door. It doesn’t throw out anyone already inside. That’s why you check users and plugins afterwards. ### Is my cheap hosting plan safe? Ask them in writing which PHP version you’re on and when they patched. Good hosts answer in a day. ### Do I need a security plugin? A firewall helps, but it doesn’t replace patching. Patching is the job. ### Should I take my site down? Only if you can’t get PHP patched quickly. Serve a maintenance page with a 503 status so Google knows it’s temporary. ## Things your agency won’t say - “Hosting is included” rarely means someone is watching your PHP version. Ask. - Two-factor login didn’t stop the UpdraftPlus attack. Keys beat passwords. - A site check every month takes ten minutes and saves a weekend. ## Jargon Jail **Locked up: “PHP”** The programming language WordPress is built on, running quietly on your hosting server. **It’s the engine under your site, and your host decides which version it runs.** ## Where to go next - Start with the basics: [What is SEO?](/blog/what-is-seo) - Why a site that vanishes hurts: [How long does SEO take?](/blog/how-long-does-seo-take) ## Sources 1. Search Engine Journal, [“Critical PHP Core Vulnerabilities Affect Websites, Including WordPress”](https://www.searchenginejournal.com/critical-php-core-security-flaws-affect-websites-including-wordpress/593812/), 21 October 2026, updated 24 October. 2. Search Engine Journal, [“UpdraftPlus WordPress Plugin Security Breach Enables Backdoor Attacks”](https://www.searchenginejournal.com/updraftplus-wordpress-plugin-security-breach-enables-backdoor-attacks/593909/), 21 October 2026. 3. Search Engine Journal, [“Google Reminds Sites To Serve A 503 During PHP Patch Downtime”](https://www.searchenginejournal.com/google-reminds-sites-to-serve-503s-during-server-downtime/593873/), 21 October 2026. --- From [DumbCMO](https://dumbcmo.com): The marketing notes you were too embarrassed to take.