October 21, 2026

PHP Security Update

Posted at 9:31 am
Resolved

As widely reported, two critical vulnerabilities were recently identified in PHP, the core programming language powering WordPress. Our security teams have been actively monitoring the situation and implementing several mitigating actions.

As of 8:40 AM CDT (13:40 UTC) today, PHP has begun to release patches and other mitigating steps to resolve the vulnerabilities. Our team is working to roll out these updates across all customer platforms as soon as possible. In addition, we have already deployed protective mitigations at the CDN layer via Cloudflare and Fastly.

We will share further updates as deployment progresses.

Updates

Updated on 2026-10-21 12:30 pm

We are currently deploying patches for the Flywheel platform. Protective mitigations are still active at the CDN layer and at the host layer. Further updates will be provided as they are available.

Updated on 2026-10-21 02:00 pm

WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on the Flywheel platform. The patch has been applied to your PHP version, and no action is needed from you. If you have any additional questions, please reach out to your support team.

Updated on

October 20, 2026

We are investigating an issue affecting some installs hosted in the GCP europe-west2 region. Affected sites may experience loading issues or gateway timeouts. Our internal teams are actively investigating the issue and working to determine the cause and impact. We will provide updates as more information becomes available.

Updates

Updated on 2026-10-20 09:41 am

We are currently working with our impacted vendor partner who is investigating downtime and 522 errors for a subset of customers in the EU region. Updates will follow when available.

Updated on 2026-10-20 11:34 am

We are still working with our impacted vendor who is continuing to investigate cause of downtime for a subset of our customers in the EU region. For direct vendor updates please see: https://status.cloud.google.com/incidents/Xs2XTHzAVC9YnafnPyzj

Updated on 2026-10-20 12:23 am

Our vendor has identified the service degradation affecting a subset of our customer in the EU region as being caused by a power event. They are working to restore services and we will continue to update as more information becomes available.

Updated on 2026-10-20 01:26 pm

Our vendor has successfully restored their services affected by recent power outage. We have seen a full recovery of the subset of sites within the EU region post-vendor service restoration.

August 18, 2026

We are aware of an issue impacting some Flywheel sites. Affected sites may intermittently return a 503 status code. We are currently investigating.

Updates

Updated on 2026-08-18 01:52 pm

We have identified the root issue and applied a fix.