Pricey Buyer,
The day before today used to be a tricky day for far of the web with the leaked embargoed announcement of 2 serious CVEs affecting PHP – CVE-2026-109618 and CVE-2026-109619. Either one of those vulnerabilities required each and every internet host working PHP, together with WP Engine, to use PHP patches straight away upon liberate.
Importantly, our shoppers don’t wish to take any motion. As a controlled web hosting supplier, WP Engine labored across the clock to offer protection to our shoppers’ websites, first by way of imposing proactive mitigation after which by way of making use of the patch upon its liberate. All buyer websites are working absolutely patched variations of PHP.
We acknowledge that the majority of our shoppers have business-critical websites, which is why they have got invested in controlled web hosting. You, as a buyer, shouldn’t must consider safety. Now that the mud has settled after effectively patching all of our infrastructure, I’ve had time to replicate on how we at WP Engine can higher keep up a correspondence with our shoppers. We understand now not all of our shoppers gained related and common standing updates, and we need to just be sure you know the stairs we’re taking to offer protection to you. We’re discussing this with our groups and are committing to enhance conversation processes transferring ahead.
To that finish, it is very important supply extra information about what WP Engine did in particular to offer protection to your web sites hosted on our platforms.
In a while after nighttime US Central Time on October 21, in accordance with knowledge we now have been following and had gained concerning the vulnerabilities, our Safety Group straight away enabled the newest Internet Software Firewall (WAF) regulations to hit upon and block probably malicious requests to shoppers at the WP Engine and Flywheel platforms.
Moreover, by way of 3:00 AM US Central Time on October 21, we deployed the really useful mitigations to our PHP configuration throughout all platforms whilst we waited for authentic patches to start out rolling them out with a view to absolutely give protection to shoppers from the danger of disclosed CVEs.
Once we gained authentic patches from our undertaking PHP Lengthy-Time period Reinforce (LTS) supplier, we started checking out them and deploying to our platforms, patching all buyer websites. Whilst the up to date PHP variations have been being deployed around the platforms, the mitigations we had deployed within the morning hours the day before today supplied a degree of coverage for each and every buyer.
We didn’t really feel at ease declaring that buyers have been absolutely secure till we have been in a position to totally practice the authentic PHP patches to all buyer websites.
Our groups proceed to actively observe site visitors and community requests to verify no tried exploits have been a success. Over the last 24 hours, our controlled WAF regulations blocked a couple of million requests related to those PHP vulnerabilities, and we now have noticed no a success exploit makes an attempt.
We worth each and every one among our shoppers and your comments. When you have any questions, we’re right here to assist. Thanks for trusting us with what you are promoting!
Sincerely,
Slade Cozart
VP, Buyer Revel in
Standing Web page | WP Engine Portal
The submit Two serious CVEs affecting PHP seemed first on WP Engine®.
WordPress Hosting