Resolved on October 21, 2026, affecting Flywheel platform.
WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on the Flywheel platform. The patch has been applied to your PHP version, and no action is needed from you. If you have any additional questions, please reach out to your support team.
Affected components
Update timeline
- resolved Oct 21, 2026, 02:31 PM UTC
As widely reported, two critical vulnerabilities were recently identified in PHP, the core programming language powering WordPress. Our security teams have been actively monitoring the situation and implementing several mitigating actions. As of 8:40 AM CDT (13:40 UTC) today, PHP has begun to release patches and other mitigating steps to resolve the vulnerabilities. Our team is working to roll out these updates across all customer platforms as soon as possible. In addition, we have already deployed protective mitigations at the CDN layer via Cloudflare and Fastly. We will share further updates as deployment progresses.
- resolved Oct 21, 2026, 02:31 PM UTC
Update
- monitoring Oct 21, 2026, 05:30 PM UTC
We are currently deploying patches for the Flywheel platform. Protective mitigations are still active at the CDN layer and at the host layer. Further updates will be provided as they are available.
- monitoring Oct 21, 2026, 07:00 PM UTC
WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on the Flywheel platform. The patch has been applied to your PHP version, and no action is needed from you. If you have any additional questions, please reach out to your support team.
Your product runs on more than Flywheel
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services