Automattic Inc.

WordPress.com / WordPress VIP / WP Cloud / Pressable / Tumblr

Response status

Patches applied

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Hosted sites on WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr are protected. The provider manages PHP at infrastructure level.

What users should do

No PHP patch action on the listed services. WordPress installed on a separate self-managed server requires a PHP update there.

Official service URL

• https://wordpress.com/

Source URLs

1. Automattic: PHP vulnerability responsehttps://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/Response evidence
2. https://wordpress.com/blog/https://wordpress.com/blog/Service and operation documentation

Jetpack

Response status

Not listed (Jetpack-specific response)

Response information checked

2026-10-27

Current re-audit: Official sources searched; no response found · Research date: 2026-10-27

No official statement confirming Jetpack alone mitigates or fixes these PHP flaws was found.

Scope: Automattic hosted-platform protection is not extended to Jetpack sites on external hosts.

What users should do

For self-hosted WordPress, ask your host or administrator to verify PHP patching.

Source URLs

1. https://jetpack.com/resources/https://jetpack.com/resources/Service and operation documentation
2. https://jetpack.com/support/jetpack-firewall-in-jetpack-protect-plugin/https://jetpack.com/support/jetpack-firewall-in-jetpack-protect-plugin/Service and operation documentation
3. Automattic: PHP vulnerability responsehttps://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/Service and operation documentation