Updating your plugins will not fix this one
PHP, Node and Ruby all patched serious holes in October 2026, and the PHP and Node ones are already being exploited. The bug is in the runtime, not your plugins.
PHP, Node and Ruby all shipped fixes for serious security holes within the same week in October 2026. The PHP and Node ones are already being used against real sites. The awkward part: your plugin updates do nothing about it, because the bug is not in a plugin. It is in the runtime your site sits on top of.
PHP runs roughly seven in ten websites, so for most people reading this, the first one applies.
What to do
- Find your current PHP version. In WordPress it is under Tools, then Site Health, then Info. On most hosts it is also in the control panel.
- Take a backup before you change anything. A PHP version jump is one of the few changes that can take a site down in a way you cannot click your way out of.
- Update the runtime, not the plugins. On shared hosting this is a dropdown in the control panel, usually labelled something like PHP configuration.
- Load the front end and the admin, and check a form actually submits. Plugins occasionally break on a version bump.
- If you run Node or Ruby anywhere, do the same for those.
If any of that sounds like a bad evening, ask your host. “Please update my PHP to the latest patch release” is a normal support ticket and most hosts will do it while you wait.
Why this one is different
Most WordPress security advice is about plugins, because that is where most problems are. A runtime bug sits underneath all of it — every plugin on the site inherits it, and no amount of updating them helps. It is also invisible from inside WordPress, which is why people miss it entirely.
Every source for this is official — PHP, Node, Ruby and the US cyber agency’s list of what attackers are actively exploiting. They are all on the links page. Check the dates against your own versions rather than taking my word for it.