What Is Remote Code Execution? A Plain Guide for Site Owners

Key takeaways

• RCE means a stranger runs their own commands on your server. They do it over the internet, with no physical access. Splunk's explainer describes it as running unauthorized code on a system from a distance.
• It is rated critical because of what comes next. Once code runs, the attacker is not limited to reading one page or one file. Their reach depends on the server, but the ceiling is high.
• It is not the same as a leaked password or a data leak. Those give a stranger a key or a copy. RCE can hand over the engine room.
• A critical score is about severity, not your personal risk. FIRST.org says the Base score reflects the flaw itself and should be combined with threat and environment details to judge risk.
• The fix is almost always an update. Patching, limited permissions and a firewall in front of the site each cover a different part of the problem.
• The October 2026 PHP flaws are a live example. Our main guide to the PHP vulnerability has the action list.

What is remote code execution, in plain words?

Every website runs on a computer called a server. The server runs software that follows instructions: show this page, save this form, send this email. Those instructions are code.

Remote code execution means someone outside your business finds a gap that lets them add their own instructions, and the server runs them. "Remote" means they do it over the internet. "Code execution" means the server does what they say.

Security people call this wider family "arbitrary code execution", and RCE is the version done over a network. The CWE-94 entry from MITRE describes the common cause: software builds code using outside input and fails to clean out the parts that could change what the code does. CWE-77 from MITRE describes a close cousin, where the software builds a command from outside input in the same careless way.

How does an RCE attack happen?

Splunk's explainer groups RCE attacks into three types.

1. Injection. The attacker sends specially shaped text, and the software treats it as instructions instead of plain data. OWASP's code injection page says an attacker in this case is limited mainly by what the injected language can do.
2. Deserialization. The attacker tampers with data the software unpacks and trusts, so the unpacking step runs something unexpected.
3. Out of bounds writes. The attacker sends something that overflows a memory space and overwrites things nearby.

The October 2026 PHP flaws are in the memory family. The NCSC alert of 21 October 2026 says an attacker could trigger an out of memory state in PHP, which causes memory corruption, and that this could be used for unauthenticated remote code execution under certain conditions. "Unauthenticated" means no login is needed.

Why is RCE rated critical?

Security teams score flaws with a system called CVSS. FIRST.org, which maintains it, defines Critical as a score from 9.0 to 10.0 in version 4.0. The two PHP flaws are both rated 9.2 on GitHub's php-src advisories, so they sit in that band.

Here is what the scale looks like, from the FIRST.org specification.

RCE tends to land at the top because of two things together: it can be done from far away, and the outcome is the ability to run commands, not just see one file. One caution from FIRST.org: the Base score measures how bad the flaw is by its own traits. It does not know whether your site is exposed, patched or behind a firewall. So a 9.2 means "treat this seriously and check", not "your site is broken".

What could an attacker do with RCE?

Splunk lists these outcomes as possible once an attacker can run code:

• Steal or change data such as customer records.
• Crash or slow your site, causing downtime.
• Run cryptomining software on your hardware.
• Deploy ransomware that locks files.
• Leave a backdoor so they can come back later.
• Delete or modify files and launch further attacks.

MITRE's CWE-94 page adds a quieter point: actions done by injected code are often not logged. That is why the NCSC asks organisations that cannot update to check for signs of compromise and backdoors. Our guide on checking if a WordPress site is hacked covers that step.

What could an attacker not do?

This part matters, because fear makes people guess.

• RCE does not reach every system you own. The code runs as the server's own user. A server set up with limited permissions gives the attacker less to work with. Splunk lists least privilege as a defence for this reason.
• It does not reach things that are not on that server. Your email inbox, your bank login, and a website hosted elsewhere are separate systems. An attacker may try to hop across, but it is a second step, not a built in feature.
• It does not mean your site was attacked. A flaw is a possibility. We have not independently confirmed attacks as of 22 October 2026, and headlines about exploit attempts are not proof about any one site.
• It does not work on software that is not there. If your site is on a platform with no PHP serving it, such as a static site, this particular flaw has nothing to attach to. Our post on whether Webflow runs PHP looks at that.

How is RCE different from a data leak or a stolen password?

This is our own plain language comparison, not a formal category list. The point is that RCE is about control of the machine, while the other two are about a key or a copy.

What protects you from each bad outcome?

No single tool covers everything. This table pairs the outcomes above with the defences that help, based on the Splunk and NCSC advice and standard practice.

A web application firewall, or WAF, filters traffic before it reaches your site. Splunk lists it as one defence, and WordPress.org notes that hosts may add WAF rules for the PHP issue. Our post on whether a firewall replaces PHP updates explains why it is a helper, not a cure.

How do the October 2026 PHP flaws fit in?

In short: php.net announced on 21 October 2026 that the fixed release for its branch fix two critical flaws that can allow unauthenticated remote code execution. The NCSC says all PHP versions are considered affected and asks organisations to find every PHP install and update. The full story, with the temporary settings php.net lists, is in our main PHP vulnerability guide.

The practical steps are covered in two other posts. To find your version, see how to check and update your PHP version on WordPress. To push your host for a clear answer, see what to ask your web host about the PHP security fix.

How we help

Our team builds and looks after sites on WordPress, Webflow, Framer and Shopify, so what runs behind the page, and who keeps it patched, is part of every project. If your site is on WordPress, WordPress development and Webflow maintenance cover the update routine. If you would rather not manage server software at all, Webflow migration moves a WordPress site across and keeps your URLs. Our post on website maintenance costs shows how this work fits a yearly budget.

Frequently asked questions

What does remote code execution mean?

It means someone outside your business can make your server run commands they chose, over the internet, without being physically present. It comes from a flaw in software, not from a person choosing a weak password.

Is RCE the same as a hack?

Not exactly. RCE is the flaw or the capability. A hack is when someone actually uses it. A site can have the flaw and never be attacked, and the fix is to patch before that happens.

Why do people call RCE critical?

Because it can be done remotely and can give the attacker control of the machine. FIRST.org defines Critical as 9.0 to 10.0 on CVSS v4.0, and the two October 2026 PHP flaws are rated 9.2 on GitHub.

Can antivirus or a strong password stop RCE?

A strong password does not stop a software flaw, because no login is needed for an unauthenticated RCE. Updating the software is the main defence. A firewall, limited permissions and backups are supporting layers.

Does RCE steal my data automatically?

No. It gives an attacker the ability to run commands, and what they can reach depends on the server's permissions and what is stored there. Splunk lists data theft as one possible outcome, along with downtime, ransomware and backdoors.

How do I know if my site is affected by the PHP flaws?

Find your PHP version and compare it with the fixed releases. The Info tab of Site Health in WordPress shows the PHP version under Server. Then ask your host in writing whether the fix is applied.

Should I take my site offline?

The NCSC says to consider taking a system offline if you cannot patch or apply the temporary measures. WordPress.org says the same for self managed hosting on PHP older than 8.2, while you update. This is general advice, not a guarantee, and not legal advice.