Status as of October 26, 2026: WP Engine reports patching PHP (one source; not confirmed in a second primary source as of October 26, 2026).
The short answer
WP Engine reports running patched PHP from its enterprise PHP LTS provider: All customer sites (WP Engine and Flywheel). We found one primary source, the host’s own statement; a second wasn’t found as of October 26, 2026. A host’s statement covers its managed platform, not a server you run yourself (source: GoDaddy). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).
Fix status on WP Engine
| What | Fixed build or status | Advisory | Confirmed? | Sources |
|---|---|---|---|---|
| All customer sites (WP Engine and Flywheel) | Host reports running patched PHP from its enterprise PHP LTS provider. WP Engine says customers need take no action. | WP Engine blog, Oct 22, 2026 | No: one source (as of October 26, 2026). Can’t tell from version | WP Engine: PHP vulnerability update |
How to check on WP Engine (read-only)
Ask WP Engine support to confirm, for your account, the PHP build serving your sites and when it was applied.
If someone else runs your server, ask them in writing: the questions and a copy-ready email. If it’s your own VPS or server, nobody patches PHP for you; check it with the steps for your Linux distribution in the status table. (source (source: GoDaddy))
CVE-2026-115560
On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).
On WP Engine: WP Engine’s post doesn’t mention CVE-2026-115560.
Notes for WP Engine
- WP Engine reported that its firewall blocked more than one million requests tied to these vulnerabilities in 24 hours, with no successful exploit attempts (source: WP Engine).
- WP Engine’s linked status page showed only “Loading…” for us on 24 and October 26, 2026, so we found only one readable WP Engine document.
- Your host may have patched PHP: WP Engine said it did. Ask for written confirmation for your account (source: GoDaddy).
Sources (checked October 26, 2026)
- WP Engine: PHP vulnerability update. Page date: Oct 22, 2026. States: All customer sites run patched PHP from its enterprise PHP LTS provider; customers need take no action; WAF blocked more than one million requests in 24 hours, no successful exploit attempts.
Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.
Related
WordPress.com · SiteGround · All platforms · How to prove your server is patched · What to ask your host or developer
Want it checked for you?
- Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
- Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.