PHP security update fixes two critical vulnerabilities
The PHP security update released on October 21, 2026 fixes two critical vulnerabilities in the software underneath every WordPress website. PHP is the server-side programming language used to run WordPress. The PHP project issued versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address both flaws, one day after its security team gave advance warning of the release.
Each vulnerability received a 9.2 rating under the Common Vulnerability Scoring System version 4.0 (CVSS v4.0), a scale from 0 to 10 used to describe the severity of security flaws. A score of 9.2 is in the Critical range. The advance notice scheduled the release for October 21 at 14:00 UTC, or 10:00 AM Eastern, but said it could arrive sooner if information about either flaw became public or the team observed evidence of active exploitation. The updated notice confirms that the fixes are available, but does not itself provide CVE identifiers or explain the technical conditions needed to trigger the vulnerabilities.
The PHP security update matters to WordPress users regardless of their chosen plugins or themes. PHP is installed on the web server rather than included within WordPress itself, so WordPress automatic updates cannot apply these fixes. Updating the WordPress core software, plugins or themes also does not change the PHP version running on the server. Because the technical details are not set out in the updated notice, it is not possible to determine from that notice alone how easily either vulnerability could be used against a WordPress website.
Responsibility for the update depends on the hosting arrangement. Providers generally manage PHP on shared and managed hosting. The customer or their developer is usually responsible on a virtual private server (VPS), which is a remotely hosted server environment reserved for that customer, as well as on dedicated servers and other self-administered systems. Website owners should check whether their provider has installed one of the fixed releases rather than assuming a normal WordPress update covered it.
WordPress administrators can find the installed version by opening Tools, selecting Site Health, choosing the Info tab and expanding the Server section. According to the PHP project's supported-versions page, PHP 8.5 and 8.4 are in active support. PHP 8.3 receives security fixes only until December 31, 2027, while PHP 8.2 receives them until December 31, 2026. PHP 8.1 and older releases no longer receive security fixes directly from the PHP project.
There are limited exceptions for older systems. The PHP project states that some Linux distributions and long-term support (LTS) vendors provide backported fixes, meaning they adapt a newer correction for an older software release. The PHP security team has also published minimal source backports for PHP 7.4, 8.0 and 8.1 for administrators who build PHP from its source code. Those provisions do not make every old installation secure by default. Owners of sites on PHP 8.1 or earlier should ask their host about moving to a supported branch and test first, because older WordPress plugins and themes can stop working with newer PHP versions.
Administrators managing their own systems should obtain the PHP security update through the channel used to install the software. Operating-system packages, hosting control panels and container images, which are packaged software environments used to run applications consistently, can publish their updates on a different timetable from php.net. Check that channel for the corrected package and plan a maintenance window. Before making the change, create a fresh copy of the website files and database, verify that the backup can be restored, and test the updated PHP release on a staging site, a private copy of the website used for checks before changes reach visitors.
The PHP project announces releases through the php.net homepage. Wordfence said its Threat Intelligence team was monitoring the release and would examine how the vulnerabilities could affect WordPress, including whether firewall protection was possible. It also stressed that some flaws in PHP itself can only be corrected by updating PHP, making the server update the central action even if other protections are later developed. Wordfence has since directed readers to a separate advisory covering the fixed versions and subsequent steps.
For site owners who prefer not to administer the server layer themselves, AEU Hosting offers managed WordPress hosting secured end to end. Whatever hosting model is used, the immediate task is to identify the installed PHP version, establish who controls its updates, confirm that a fixed release has been installed and retain a tested backup in case the change causes compatibility problems.