Important: critical PHP security issue affecting WordPress sites

Not a Groundhogg bug, but it affects your site. Here's what to do before the patch.

⚠️ Critical PHP security issue Action needed

Hi siteowner,

We're reaching out as a courtesy because a critical security issue was disclosed this week that affects nearly every WordPress site, including yours. This is not a Groundhogg bug. It's in PHP itself, the language WordPress runs on.

Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) can let an attacker run code on your server without logging in. The PHP team is releasing a fix on Wednesday, October 21 at 10 AM ET, and a working exploit is reportedly already circulating.

🐘 Still on PHP 7? Please read this.

Only PHP 8 will receive the fix. PHP 7 reached end-of-life years ago and will stay vulnerable permanently. Ask your host to upgrade you to PHP 8.3 or 8.4 as soon as possible. Most hosts can do this in a few clicks from your hosting dashboard.

Check your version in WordPress under Tools > Site Health > Info > Server.

🛡️ Temporary protection you can apply today

The suspected attack path is a PHP feature WordPress doesn't use, so you can turn it off safely. Ask your host to set:

session.upload_progress.enabled = 0

If you manage your own server, add it to php.ini and restart PHP. On LiteSpeed or Apache mod_php servers, you can add this line to the top of your .htaccess file instead:

php_flag session.upload_progress.enabled off

This won't affect Groundhogg, your forms, or uploads. It's a stopgap, not a replacement for updating PHP.

🏢 On shared hosting?

On some shared servers, a compromise of one site can affect every site on the same server, whether or not you did anything wrong. Ask your host how they're handling this.

✅ Your checklist

Check your PHP version, and upgrade from 7.x to 8.x if needed.
Ask your host to apply the stopgap above.
Make sure your host applies the PHP patch after Oct 21.
Take a backup and update WordPress, your plugins, and your themes.

Questions? Just reply to this email and our support team will help.

Stay safe,
— Adrian

👎 I hated this email

🤷 It was fine

👍 I loved this email

From 🍁 with 💌