The PHP security team released emergency patches on October 21, 2026, to close two critical vulnerabilities in PHP itself. Both flaws allow an attacker to run code on a web server without needing to log in, and details of the issues leaked publicly before the official fix was ready, meaning attackers may already be aware of how to exploit them.
Because PHP powers the server-side logic behind every WordPress site, this is not something a WordPress core update can fix. The patch has to be applied at the hosting level.
Which PHP Versions Are Fixed
The following patched releases address the vulnerabilities:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Sites still running PHP 8.1 or older are on a version that no longer receives regular security updates. Those sites need to be upgraded to one of the patched releases above rather than simply applying a point update.
What WordPress Site Owners Should Do Now
- Check your PHP version. In the WordPress dashboard, go to Tools, then Site Health, open the Info tab, and check the Server section.
- Back up your site before making any changes, in case the update causes compatibility issues with plugins or themes.
- Update to a patched version. Most hosting dashboards let you switch PHP versions directly. If the option isn’t visible, contact your host and ask them to move your account to a patched release.
- Check for signs of compromise. Updating PHP stops new attacks but does not remove an attacker who may already have gained access. Look for unfamiliar admin accounts and files that changed unexpectedly.
If you are not able to update right away, reach out to your hosting provider and ask them to apply the fix on your behalf. Given that exploit details have already leaked, unpatched servers should be considered at immediate risk until the update is applied.