WP Engine Confirms Two Critical PHP Vulnerabilities, Assures Customers They’re Being Monitored by Several Very Expensive Dashboards
AUSTIN, TX — WP Engine announced Wednesday that two critical vulnerabilities had been discovered in PHP, the programming language responsible for powering approximately 43,000 WordPress plugins, 19 million abandoned websites, and a contact form that hasn’t worked since 2017.
“We want to assure customers that our security teams are actively monitoring the situation,” said a WP Engine spokesperson, standing in front of six monitors displaying the word “CRITICAL” in various shades of red. “We’ve also implemented protective mitigations at the CDN layer, which sounds incredibly reassuring and is exactly why we said it.”
According to the company’s official incident report, the vulnerabilities were identified at precisely 8:40 AM CDT, the exact moment thousands of WordPress administrators were peacefully drinking coffee, unaware that the software holding their businesses together was once again secured primarily by hope.
PHP developers have reportedly begun releasing patches, an unprecedented development that briefly caused the WordPress community to wonder whether updating something might actually fix it.
Meanwhile, WordPress founder Matt Mullenweg reportedly seized the opportunity to remind everyone that the real security vulnerability is WP Engine’s continued existence.
“PHP may have two critical vulnerabilities, but WP Engine has a third: not contributing enough to WordPress,” Mullenweg allegedly declared in a completely fictional statement that somehow still feels plausible.
Security experts recommend that WordPress administrators immediately update PHP, WordPress core, all 47 plugins, their theme, three abandoned premium extensions, and something called “Classic Editor” that nobody has dared deactivate since 2019.
Customers were also encouraged to test the updates on staging environments before deploying them to production, a process that will reportedly take four hours before someone accidentally clicks “Push to Production” and overwrites the entire live database.
WP Engine confirmed that Cloudflare and Fastly have already deployed protective measures, meaning attackers must now successfully identify nine motorcycles, three traffic lights, and a bicycle that may or may not be a fire hydrant before exploiting anything.
“We take these vulnerabilities extremely seriously,” the spokesperson added. “That’s why our first priority was making sure the incident had its own professionally formatted status page.”
At press time, WP Engine had issued another update titled “PHP Security Update — Monitoring,” while 14 WordPress security plugins simultaneously emailed administrators to inform them that their websites might be vulnerable unless they upgraded to the Pro version for $199 annually.
UPDATE: The vulnerabilities have been patched. Unfortunately, the patch broke Gravity Forms, WooCommerce checkout, and a Beaver Builder module last updated in 2021.
WP Engine has opened a new incident.
Status: Investigating.