Still Using WordPress? The NSA Would Like a Word.

An emergency PHP warning, another patch scramble, and a brief visit to the "I told you so" department.

I've been telling people to get their businesses off WordPress for years. Now the NSA has entered the conversation. And while their advice is considerably more diplomatic than mine, "take the system offline" is a fairly strong opening statement.

Two critical vulnerabilities in PHP—the software underneath WordPress and many other web applications—have triggered emergency patches and an official NSA warning. Known collectively as PHP2Shell, the flaws can allow attackers to execute code on affected servers without logging in.

To be clear, the NSA hasn't recommended abandoning WordPress. It recommends urgently patching affected PHP systems and taking them offline if an immediate update isn't feasible until they can be fully mitigated.

The "maybe stop building your business on this thing" recommendation remains mine. I'm comfortable with that division of labor.

The Problem Beneath the Problem

In PSA: Get Your Business Off WordPress, we talked about what business owners actually inherit when they buy a WordPress website.

Core software. Themes. Plugins. Hosting. Dependencies. An ongoing collection of things somebody needs to understand, monitor, and maintain.

A software supply chain wearing a nice homepage.

This time, the emergency is underneath the plugins. Updating WordPress and clicking "update all" doesn't fix the PHP runtime executing the site. The vulnerability lives below your dashboard. Your homepage can look beautiful while the software serving it needs an emergency repair. But hey, the testimonials still slide sideways.

Here's What You Need to Do

Contact your hosting provider or server administrator right away. Ask them to confirm that the PHP actually serving your website has been patched for CVE-2026-109618 and CVE-2026-109619.

PHP released fixes on October 21 in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Some providers supply equivalent fixes through their own maintained packages, so get explicit confirmation covering both vulnerabilities. PHP's maintainers say updating is the complete solution; interim measures only reduce particular attack paths.

"We keep things updated" is a comforting sentence.

"Both fixes are deployed to the PHP serving your site" is the answer you need.

Yes, I'm Going to Say It Again

Every platform needs maintenance. Moving to something else doesn't automatically make you secure. But maintenance burden belongs in the purchasing decision. Who owns the updates? Who notices the warning? Who deploys the fix? Who checks that it worked?

If the answer is a business owner who thought they were buying a website rather than accepting a part-time infrastructure job, something went wrong during the sales presentation. My objection to WordPress has always included that gap: how easy it is to assemble something, versus what it takes to operate it responsibly. A cheap launch can come with a very expensive subscription to surprise.

And AI Is Accelerating the Conversation

OpenAI says researchers at Calif used GPT‑5.6 Sol to identify a critical PHP flaw through its Patch the Planet initiative. Wiz independently discovered and reported both vulnerabilities, and PHP's maintainers led the fixes. OpenAI also released a Codex version checker to help operators assess potential exposure.

AI is helping find weaknesses in the software we already depend on. That makes the ability to respond quickly even more important.

Somebody still has to install the damn patch.

If you're already on WordPress, handle that first. Then revisit whether the architecture—and the responsibility attached to it—still makes sense for your business. And if your agency recommends WordPress for a new project, ask why. You deserve a better explanation than familiarity and a favorite template.

The NSA wants the vulnerable software patched. I'd like you to reconsider the vehicle.

The Yugo has a recall. Again.

---

Rich Washburn is a technologist, strategist, and Founder & Chief AI Architect of ARIA AI Labs, working at the intersection of AI, infrastructure, communications, and capital. He also serves as Managing Partner and Chief AI Officer at Eliakim Capital.