Comment by sjs382

11 hours ago

Despite this coordination, WP-Engine (who's major business is hosting WordPress sites) is still on PHP 8.4.26 a full 2.5 hours after the patch is publicly available.

https://wpenginestatus.com/incidents/969801

5 comments

sjs382

Reply
system2  4 hours ago

It took 8 hours for CloudWays (DigitalOcean) to apply the patch. Big companies suck at responding to major stuff like this.

  • kimos  39 minutes ago

    They also have more to coordinate and manage. I don’t think it’s fair to frame it as them being bad at something. What they have to do is much harder, and it takes time.

    When I’ve worked at small places, a security patch is bumping some versions and restating some servers.

    I worked at a massive Rails shop for a decade and a big security bump meant mobilizing a team, coordinating updating dozens or hundreds of apps, all while maintaining platform stability and staying within SLAs. It’s a nightmare.

    • system2  22 minutes ago

      We have 4 servers with CloudWays. 2 of them are still not patched (20 hours since the patch was released). We cannot control the PHP version for our customers. Sucks to suck.

dizhn  10 hours ago

Could be backported?

  • throwaway82931  5 hours ago

    I'm checking by ssh'ing into my environment, and this is what I see as of 21:41 UTC, several hours after the patches were published:

        wpe-user@MYENVIRONMENT.ssh.wpengine.net:~$ php -v
    PHP 8.4.26 (cli) (built: Sep 23 2026 06:24:29) (NTS)
    Copyright (c) The PHP Group
    Built by Perforce Zend (www.zend.com)
    Zend Engine v4.4.26, Copyright (c) Zend Technologies
        with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies

    I keep hoping for either a change in the version or the build date, but nothing yet. The incident status page says they're deploying, but there haven't been further updates about how far along they are.