hosting
WP Engine: security status
Summary
Official status incident "PHP Security Update" (Oct 21 13:40 to Oct 22 01:19 UTC): mitigations at the CDN layer (Cloudflare and Fastly) and the hosting layer on Oct 21, with every PHP version on the platform (7.4, 8.2, 8.4, 8.5) to be updated; at 01:19 UTC on Oct 22: "WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on our platform ... no action is needed from you." Updated versions: 7.4.33.17, 8.2.35, 8.4.27, 8.5.12. A blog post the same day: "All customer sites are running fully patched versions of PHP."
Customer action:
No action is needed for this fix. PHP 7.4 is out of upstream support, so plan a move to a supported PHP in the User Portal.
Source: https://wpengine.com/blog/php-vulnerability-update/
Verified: 2026-10-26
Managed WordPress. Sites run on Google Cloud and AWS behind Cloudflare (Advanced Network, 141.193.213.10/.11 from Cloudflare's AS209242), so the ASN shows Cloudflare or the cloud, not WP Engine; sites are recognised by their CNAME to wpengine.com / wpenginepowered.com / wpeproxy.com / wpewaf.com, or by WP Engine's x-cache-group response header. WP Engine's headless platform and Flywheel are not covered by this entry.
How this tool recognises the provider
- CNAME
*.wpengine.com*.wpenginepowered.com*.wpeproxy.com*.wpewaf.com- Response headers (names)
x-cache-group