WP Engine is currently experiencing a minor incident affecting North America and Europe and 1 more component, which began 10h ago. The vendor's full update timeline is below.
Affected components
Update timeline
- identified Oct 21, 2026, 01:40 PM UTC
As widely reported, two critical vulnerabilities were recently identified in PHP, the core programming language powering WordPress. Our security teams have been actively monitoring the situation and implementing several mitigating actions. As of 8:40 AM CDT (13:40 UTC) today, PHP has begun to release patches and other mitigating steps to resolve the vulnerabilities. Our team is working to roll out these updates across all customer platforms as soon as possible. In addition, we have already deployed protective mitigations at the CDN layer via Cloudflare and Fastly. We will share further updates as deployment progresses.
- identified Oct 21, 2026, 05:30 PM UTC
We are currently deploying patches to the platform. Protective mitigations remain active at the CDN layer and at the hosting layer. Further updates will be provided as they are available.
- identified Oct 21, 2026, 09:52 PM UTC
We are continuing to deploy patches to our platform, and our proactive mitigations remain in place to help protect customers. All versions of PHP that are running on our platform will be updated, including: 7.4 8.2 8.4 8.5 We will continue to provide updates as they are available.