If you run a food blog on WordPress, you have probably seen the headlines today. They say a critical flaw puts WordPress sites at risk and attacks have already started. You did not sign up to be a server administrator, and now it feels like you are one. Here is what is actually going on, and why some food blogs are not affected at all.
The short answer: your blog is safe from this flaw only once the PHP on its server has been patched. Updating WordPress, your theme or your plugins does not fix it, because the flaw sits underneath all of them.
Updated October 21, 2026. This is moving quickly, so check your host's status page for the latest.
What happened, in plain language
On October 21, 2026, the PHP project released fixes for two flaws, CVE-2026-109618 and CVE-2026-109619. PHP rates both critical (9.2 out of 10). On a server running an unpatched version, an attacker can run their own code without logging in.
Three things matter for a food blogger:
- The flaw is in PHP, not in WordPress. PHP is the language WordPress runs on, and it lives on your hosting server. WordPress.org has said no WordPress update is required or planned. The fix has to be installed on the server, by your host or by whoever runs it.
- Almost every PHP version is affected. Wiz Research, one of the teams that found the flaws, says every PHP version back to 5.4 is affected by at least one of them. Cloudflare says the same.
- Attacks have started. Cloudflare reported early attacks on the morning of the release, and Patchstack says hosting partners have reported active exploitation.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
If your blog uses Cloudflare
Lots of food blogs sit behind Cloudflare, often on the free plan. Cloudflare says it deployed firewall rules for these flaws about nine hours before they were made public. Since early on October 21 those rules are on by default for every plan with the firewall turned on, free plans included. On a Pro, Business or Enterprise plan, Cloudflare asks you to check that its Managed Ruleset is set to block.
That buys you time, but it does not fix the problem. Cloudflare says PHP still has to be patched.
The bigger question: should a food blog need this much upkeep?
Once the urgent part is done, it is worth asking why a recipe site comes with this kind of week at all.
A standard WordPress food blog is a stack: a PHP server, WordPress, a theme, a recipe plugin, an ad plugin, a caching plugin, a security plugin. Each piece has its own updates, and some weeks one of them has an emergency. Every WordPress plugin can also reach your whole database and your files, so one weak plugin is a weak site. This week the emergency is underneath all of it. You can do everything right inside WordPress and still be exposed, because the risk sits on a server you never see.
None of that is your fault. It is how WordPress was built, more than twenty years ago, for a different web.
A different stack: EmDash
EmDash is an open-source content management system from Cloudflare, launched in April 2026 and released under the MIT license. It does the job WordPress does (posts, pages, media, an admin to edit them), on a newer design:
- No PHP. EmDash is written in TypeScript and built on Astro, a modern web framework. A flaw in PHP, like this week's, has nothing to land on.
- No server to look after. It runs on Cloudflare Workers, across Cloudflare's network. Your posts live in Cloudflare's D1 database and your photos in its R2 storage. There is no machine for you or your host to patch.
- Plugins in their own sandbox. A WordPress plugin can touch everything. An EmDash plugin runs in an isolated sandbox and gets only the permissions it declares up front, much like an app on your phone has to ask for your camera.
- It reads WordPress. EmDash can import a WordPress site from its export file or by connecting to it directly, so your archive comes with you.
No software is immune to every problem, and EmDash will have its own updates. But the kind of problem in this week's headlines, a hole in the server language under every site, is not part of its design.
Where Peristyle fits
Peristyle sites are built on EmDash, so this week's flaws do not apply to them, and Peristyle keeps the platform updated. If your recipes are on WordPress today, the import screen connects to your WordPress site, or takes the export file WordPress gives you under Tools → Export, and brings your posts across. Your recipes keep their recipe cards, and each one can fill a real cart at your local grocery store in one tap, credited to you. So you know who cooked your recipe, not only who looked at it. It is one plan, $89 a month, with your first 30 days free (card up front), and you can start on your own at peristyle.io/build.
Keith, building Peristyle: food blogs built for people, and a grocery cart that tells you who cooked your recipe. peristyle.io
Sources (as of October 21, 2026): Cloudflare · Patchstack · Codeable · Cybernews · TechRadar on EmDash