What Flywheel says
Flywheel status post 'PHP Security Update' (21 Oct 2026, now resolved): at 2:00 pm that day WP Engine finished deploying the security patches for the two critical PHP vulnerabilities on the Flywheel platform, applied to each site's PHP version. CDN-layer mitigations via Cloudflare and Fastly were in place during the rollout. The post does not name the CVEs. No customer action needed.
WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on the Flywheel platform.The patch has been applied to your PHP version, and no action is needed from you.Our team is working to roll out these updates across all customer platforms as soon as possible.we have already deployed protective mitigations at the CDN layer via Cloudflare and FastlyWhat you need to do
None needed per Flywheel. Sites on an old PHP version should still be moved to a current one in the dashboard.
Check which PHP your site runs
Sites > [site] > Advanced tab (current PHP version in right sidebar); staging sites under Staging tab
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
Sites > [site] > Advanced tab > upgrade/downgrade PHP option at lower right (staging: Staging tab)
Versions offered: 8.4, 7.4.
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
We found no paid support for old PHP versions at Flywheel.
Ask Flywheel directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello Flywheel support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.