On October 21, 2026, two critical security vulnerabilities were publicly disclosed in PHP, one of the foundational programming languages that powers a significant portion of the internet.
This was a global, industry-wide security issue, not a security failure or vulnerability involving our agency, WP Engine (our hosting provider), or WordPress. The vulnerabilities were discovered within PHP itself, an independent, widely used technology that supports millions of websites and applications around the world.
Because PHP is used by numerous website platforms, including WordPress, Drupal, and Joomla, the potential impact extended far beyond any single website, hosting company, or development agency. The discovery prompted an urgent, coordinated response across the global web hosting and technology industries to implement security protections and updates.
As part of that broader response, Lawton Marketing Group and our hosting partner, WP Engine, took steps to address the situation and protect the websites entrusted to us.
What happened
The flaws, CVE-2026-109618 and CVE-2026-109619, are in PHP itself, the language behind WordPress, which alone runs nearly 40% of all websites. Every server running PHP was at risk, no matter who built or hosts the site; GoDaddy, for one, called it an industry-wide flaw affecting all hosting providers. Both are rated critical (CVSS v4.0 score of 9.2 out of 10) and could let an attacker run their own code without logging in. Details leaked online on October 20, and attackers were trying to exploit the flaws within a day.How it was fixed
WP Engine fixed the issue on its servers, in these steps (US Central Time):- Oct 21, shortly after midnight: enabled updated firewall (WAF) rules to block attacks.
- By 3:00 AM: applied recommended PHP configuration mitigations across its platform.
- 8:40 AM: reported CDN-layer protections in place and began rolling out patches.
- 8:19 PM: finished patching; sites now run PHP 7.4.33.17, 8.2.35, 8.4.27 or 8.5.12.
- Oct 22: confirmed all customer sites are fully patched, with over 1 million related requests blocked in 24 hours and no successful exploit attempts seen.