Critical PHP Security Release: What WordPress Site Owners Should Check This Week

On October 21, 2026, WordPress.org published a notice about a critical PHP security release. Every WordPress site runs on PHP, so this is worth a few minutes today. This guide explains how to find your PHP version, what to ask your host, and how to update PHP without breaking your site.

Executive Summary

What the PHP Security Release Is

According to the WordPress.org announcement, the PHP project released a security update that fixes two critical vulnerabilities. Site owners are encouraged to update PHP immediately.

Three details are worth knowing before you act:

• The WordPress.org post does not list CVE IDs or version numbers. The PHP security advisory, checked October 23, 2026, identifies CVE-2026-109618 and CVE-2026-109619 and lists fixes in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. These are the releases named when we checked, not the only safe ones, and a supported branch number alone does not prove your server is fixed. Vendor backports can keep an older-looking version, so ask your host to confirm the patched build.
• The same post says PHP versions before 8.2 no longer receive security updates from the PHP project. If you run one, the PHP project may not provide a fix for your branch, so ask your vendor whether a backport exists, or plan an upgrade.
• Hosts may add web application firewall (WAF) rules as an interim measure. WordPress.org treats that as a stopgap, not a replacement for updating PHP.

This is separate from WordPress 7.1.3, released on October 6, 2026 with 7 security fixes and 4 bug fixes. If you have not applied it and background updates are off, update from Dashboard > Updates.

Does This Affect Your Site?

Almost certainly your site uses PHP. The real questions are which version it runs and who controls it. The answer decides what you do next.

Step 1: Check Your PHP Version

1. Log in to your WordPress dashboard as an administrator.
2. Go to Tools > Site Health and open the Info tab.
3. Expand the Server section and find the PHP version entry.
4. Compare that version with the fixed releases in the PHP advisory (8.2.35, 8.3.36, 8.4.27 or 8.5.12 when checked on October 23, 2026).

Many hosts also show the PHP version in their control panel. If your version is earlier than 8.2, put an upgrade on your list now, because the PHP project no longer issues security updates for it. An older-looking version may still be patched through a vendor backport, so ask your host to confirm.

Step 2: Ask Your Host the Right Questions

If you cannot change PHP yourself, a short message to support saves guesswork. Ask:

• Has the PHP security update from October 21, 2026 been applied to the server my site runs on?
• Which PHP version is my site using today, and is it a fixed release or a vendor-patched build?
• Are temporary WAF rules in place, and do I still need to update PHP myself?
• Can I switch PHP versions from my control panel, and which patched versions can I choose if a plugin fails?

If you host with Z.com, the WordPress Hosting page lists a PHP Version Switch among its plan features, but it does not show which plans include it. Confirm availability in your hosting account or with Z.com support. This article does not state the patch status of any specific server.

Step 3: Update PHP Safely

Changing PHP usually works, but it is not guaranteed. WordPress.org's PHP update guide recommends this order:

1. Back up your site files and database before changing anything. A website backup does not patch or replace PHP, which your host or server controls, so restoring it never fixes the vulnerability by itself.
2. Update WordPress, themes and plugins from Dashboard > Updates, then confirm the site still works.
3. Run a compatibility check, for example with the PHP Compatibility Checker plugin. WordPress.org notes it is not perfect and can miss issues or flag false positives.
4. Test the change on a staging copy if you have one. Z.com's WordPress Hosting page says its plans include a staging site feature.
5. Switch to a PHP version that is both supported and patched, then test login, forms, checkout and key pages.
6. If something breaks, do not reopen the site on unpatched PHP. Ask your host for another compatible patched PHP version or vendor-patched package while you fix the cause, such as the failing plugin. If none is available, restrict access at host or server level, or take the service offline. Restore files or the database only if necessary, because restoring an older database can lose orders or form submissions received since the backup.

On version choice: the WordPress PHP compatibility reference lists WordPress 7.1 as tested with PHP 7.4 and 8.0 through 8.5. Combined with the 8.2 cutoff above, the overlap is PHP 8.2 to 8.5, and the advisory lists a fixed release for each of those branches.

If You Manage Your Own Server

For self-managed servers on older PHP versions, the WordPress.org post suggests considering taking the server offline while you upgrade. It quotes UK National Cyber Security Centre guidance to consider taking the system offline until it can be fully mitigated. Weigh that against your business impact. A WordPress maintenance plugin or page does not stop PHP processing requests and is not security isolation. If you cannot patch yet, coordinate host or server-level access restriction, or take the affected service offline. Use a maintenance page only to tell visitors what is happening; our guide on putting your website in maintenance mode explains how.

Common Mistakes to Avoid

If You Suspect Your Site Was Compromised

Updating PHP closes the vulnerability going forward, but it does not clean a site that was already affected. Follow the first steps in the WordPress.org "My site was hacked" FAQ: document what you see, scan your site and your own computer, reset passwords, replace the secret keys in wp-config.php, and take a backup snapshot before cleaning. This article is general educational guidance, not incident response or security consulting.

Frequently Asked Questions