Critical PHP vulnerability: why your Wix website is not affected
Two critical PHP vulnerabilities threaten millions of websites. Websites on Wix and Base44 do not run PHP that you have to patch. Read what is going on and what you can do now.
Two critical vulnerabilities in PHP threaten millions of websites, but websites running on Wix or Base44 do not use PHP that you have to patch. In this article you will read what is going on with this PHP flaw, how a PHP site differs from a Wix site, and what you can still do today.
Table of contents
- What is going on with PHP?
- Why does this affect so many websites?
- What does this mean for Wix and Base44?
- Comparison: PHP site, Wix site and Base44 site
- What should you do now if your site runs on PHP?
- Switching to Wix or Base44
- Frequently asked questions
- Conclusion
What is going on with PHP?
On 20 October 2026 the makers of PHP announced that they will fix two critical vulnerabilities. The security release is scheduled for Wednesday 21 October 2026 at 14:00 UTC, which is 16:00 CEST. Both flaws are rated 9.2 on a scale of 10, according to the official announcement on php.net.
According to security sources, these flaws allow an attacker to run code remotely without logging in. That is the worst-case scenario for a web server: in the worst case an outsider can take control. The media refer to the flaws as CVE-2026-109618 and CVE-2026-109619.
The European cybersecurity service CERT-EU urges organisations to prepare for immediate patching. Those who cannot patch are advised to take the affected websites offline temporarily. An ethical hacker told the news he had already taken his own websites offline as a precaution.
What is still unclear?
At the time of writing, not all details are public, including the exact versions affected. Some reports mention all versions from PHP 5 onwards, while another source says the emergency release is planned only for PHP 8.2 through 8.5 and that no fix will come for PHP 8.1 and older. Reports on abuse also differ: Cloudflare reported the first attacks, while other sources at the time did not yet confirm any abuse. After the release, always check php.net for the final list of affected and fixed versions.
Why does this affect so many websites?
PHP is a programming language that runs on the server and builds a website's pages. According to the news, roughly 70 percent of websites worldwide run on PHP or on applications that use PHP, including well-known systems such as WordPress, Joomla and Drupal. A vulnerability in PHP itself is so serious because it is not about one plug-in you can switch off, but about the foundation the whole website rests on.
It also means that, as the owner of a PHP site, you are responsible on two fronts. The server needs the new PHP version, and afterwards you must check that your website, theme and plug-ins still work with it. On your own server or cheap hosting this job is often forgotten or postponed.
What does this mean for Wix and Base44?
At FLOR-IT we build websites on Wix Studio, Wix Harmony and Base44. None of the three runs on PHP code that you or we manage. On a Wix website you cannot even add your own PHP code: for custom code Wix supports HTML and JavaScript (via Velo), but not PHP. This week's PHP flaw therefore does not reach your Wix website through the route by which WordPress sites are threatened.
Wix also handles hosting, server security and the HTTPS certificate itself. All Wix websites have HTTPS automatically, and the company describes its security measures in the overview of Wix security measures. A separate team manages the infrastructure, so you do not have to patch servers. We cannot speak on behalf of Wix about its internal systems; the company communicates about any incidents itself.
As far as we know, Base44 websites and apps are built with modern JavaScript technology, not PHP. There too the hosting is part of the platform, so you do not have to maintain your own web server. Read more about Wix Studio security for business websites and about Base44 for businesses.
An honest caveat
"Not affected by this flaw" is not the same as "never vulnerable". No platform is entirely risk-free. Phishing, weak passwords and poorly managed user permissions remain a risk on Wix and Base44 too. Always enable two-step verification on your Wix account and give access only to people who really need it.
Comparison: PHP site, Wix site and Base44 site
The table below shows where the difference lies for you as a website owner in this incident.
| Aspect | PHP site (e.g. WordPress) | Wix site | Base44 site |
|---|---|---|---|
| Runs on PHP | Yes | No, no user PHP code | As far as known, no |
| Affected by this PHP flaw | Possibly, depending on version | Not via PHP | Not via PHP |
| Who patches servers | You or your host | The platform | The platform |
| Updating plug-ins and themes | Keep track yourself | Apps managed via the platform | No separate plug-ins |
| Offline when a flaw has no patch | May be necessary | Not because of this flaw | Not because of this flaw |
| Security maintenance effort | High | Low | Low |
What should you do now if your site runs on PHP?
If your website runs on WordPress, Joomla, Drupal or another PHP application, get started today. A practical order:
- Take stock of your websites. List all sites and the PHP version they run on. Your host or administrator can look this up.
- Make a backup. Create a full, recent backup of files and database before you update anything.
- Install the update as soon as it is available. The release is scheduled for 21 October at 16:00 CEST. Check php.net for which versions are fixed.
- Running a version without a fix? Upgrade to a supported version, put the site behind a firewall (WAF) or VPN, or take it offline temporarily.
- Test your website after the update. Check forms, payments and login pages. Older plug-ins sometimes do not work with a new PHP version.
- Watch for odd behaviour. Unknown files, suddenly slow pages or unexpected administrators are signs to call your host immediately.
Do not want to do this yourself? That is what a maintenance package is for, where someone else keeps the updates up to date for you.
Switching to Wix or Base44
A flaw like this shows how much work lies behind a PHP website. Many entrepreneurs therefore choose a platform where the server side is no longer their concern. Switching to Wix or Base44 means hosting, updates to the underlying software and basic security are handled by the platform.
How fast that goes depends on your website. A simple business website with a few pages can in many cases be moved technically within a few hours. A web shop with many products, integrations or its own form structure takes more time. A good migration has four steps:
- Inventory of your pages and texts, so nothing is lost.
- A URL overview with redirects, so your Google rankings are kept.
- A new build in Wix Studio, Wix Harmony or Base44, matching what your website needs to do.
- Testing and going live without your website going down.
For a broader comparison, also read why companies are switching from WordPress in 2026 and our Wix Studio versus WordPress comparison. See our services and pricing for what a switch costs.
Frequently asked questions
What exactly is PHP?
PHP is a programming language that runs on web servers and builds a website's pages before they appear in your browser. Many well-known systems, such as WordPress, are written in PHP.
Is my WordPress website at risk from this PHP flaw?
Possibly. WordPress runs on PHP, so if your server uses an affected version you are vulnerable until the update is installed. The exact list of affected versions is published with the release. Check php.net and ask your host about its plans.
Does my Wix website need to go offline?
No. Wix websites do not run on PHP code that you manage, and you cannot add PHP to them. You therefore do not need to update anything because of this flaw.
Are Base44 websites safe from this flaw?
As far as we know Base44 does not use PHP, so this specific flaw does not affect your Base44 website. Security measures such as strong passwords and controlled access remain important there too.
How long does switching to Wix or Base44 take?
A simple business website is often moved technically in a few hours. Web shops and websites with many integrations take more time. After a short introduction we give you a concrete estimate.
Will I lose my Google rankings if I switch?
Not if the migration is done well. With an overview of your current URLs and redirects, your rankings are kept. That is why this is always a fixed part of our approach.
Conclusion
This week's PHP flaws are a serious threat to websites that run on PHP, with WordPress, Joomla and Drupal at the forefront. Websites on Wix and Base44 are not affected, because they do not run on PHP code that you have to update. If your website still runs on PHP, now is the time to look at your options: patch today, or switch to a platform where you no longer have these worries.
With more than twenty years of experience and over 1,500 websites delivered, we are happy to help. Book a free 30-minute intro call and we will tell you honestly what works best for your website. Want to know more about our agency? Read about us, browse our other articles or get in touch.
Sources
- PHP.net: announcement of the upcoming critical security release
- Wix: overview of security measures
- Wix: about SSL and HTTPS
This article was written on 21 October 2026, before the expected release. Details on affected versions may change.
Also relevant for: