What's happening
We're aware of a critical security vulnerability in PHP, the programming language that powers WordPress and much of the web. On October 21, 2026, the UK's National Cyber Security Centre issued an alert about the issue, tracked as CVE-2026-109618 and CVE-2026-109619.
Under certain conditions, the flaw could let an attacker run their own code on a web server without logging in. It affects all versions of PHP, and the PHP team has released a fix, which has already been applied to Showit sites by our hosting partners.
What we're doing
Our team is actively working to address this vulnerability. Because many Showit customers run WordPress blogs alongside their Showit sites, we're working closely with our hosting partners, BigScoots and WP Engine, to monitor the situation, apply PHP security updates, and mitigate any attempted exploitation.
We'll share updates here as the situation develops. There's no action you need to take right now.
What you can do
If you notice anything unusual on your WordPress blog, please reach out to our Support team right away. Signs to watch for include:
Posts, pages, or links you didn't create
Unfamiliar admin users or unexpected changes to settings
Visitors being redirected to other websites
Warnings from your browser or Google about your site
We take the security of your site seriously, and we're here to help if you have any questions.