The PHP Security Patch Every WordPress Site Owner Needs to Check This Week

On 21 October 2026, PHP released an emergency fix for two critical security flaws, and this WordPress PHP security update is not one you can install from your dashboard. The problem sits underneath WordPress, in the PHP software your server uses to run it. If your host hasn't patched it, your site is exposed no matter how up to date your plugins are.

I spent the last week checking client sites and chasing hosts about this. Here's what happened, how to check your own site in five minutes, and what to do if the answer isn't good.

What actually happened

PHP fixed two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10, and both can let an attacker run their own code on your server without logging in. That's about as bad as website security gets.

Details of the bugs leaked before the planned announcement, so the PHP team released the fix a day early. Within a day, Cloudflare reported attack attempts climbing from thousands into the millions. Security firms have since reported real attacks against unpatched servers.

The fixed versions are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Anything older than those is affected, unless your host has applied the fix another way (more on that below).

Why updating WordPress won't fix this

This is the part that confuses most site owners. WordPress.org has confirmed that no WordPress update is needed or planned. Your plugins and theme aren't the problem either.

WordPress is written in PHP. Think of PHP as the engine and WordPress as the car. The flaw is in the engine, so only whoever controls the engine can fix it. For most people, that's the hosting company.

So the usual advice, "keep everything updated", doesn't cover you here. You can click every update button in your dashboard and still be running a vulnerable server.

How to check your PHP version in five minutes

1. Log in to your WordPress dashboard.
2. Go to Tools > Site Health, then open the Info tab.
3. Expand the Server section and look for PHP version.

You can also find it in cPanel or your host's control panel, usually under something like "Select PHP Version" or "PHP Settings".

If you see one of the fixed versions listed above, or anything newer, you're in good shape.

Your version number might not tell the whole story

Here's the catch. Many hosts patch PHP without changing the version number you see. CloudLinux, which a lot of shared hosts use, backported the fix into its own builds. A site showing 8.5.11 on one of those servers may already be safe.

That means the only reliable answer comes from your host. Send them one short message:

"Has the PHP security release from 21 October 2026 (CVE-2026-109618 and CVE-2026-109619) been applied to my server?"

Keep the reply. If they say yes, you're done. If they're vague or say "we're working on it", follow up in a day.

What to do depending on your hosting

Managed WordPress hosting. Your host handles PHP for you. Most of the big managed hosts patched quickly or put protection in front of sites while they rolled the fix out. Still, ask for confirmation rather than assuming.

Shared hosting. Check your host's status page or email notices. If your control panel lets you pick a PHP version, switch to a supported one (8.2 or newer) that your host has confirmed is patched.

A VPS or your own server. Nobody else is going to do this for you. Whoever manages the server needs to install the updated PHP packages and restart PHP today. If that's you and you're not comfortable doing it, this is the moment to get help.

Sites behind Cloudflare. Cloudflare added firewall rules for these attacks on every plan, including free. That's a useful extra layer, but it isn't a fix. Your server still needs patching.

If you're still on PHP 8.1 or older

This is where I've seen the most risk on client sites. PHP 8.1 and earlier no longer get official updates. Some hosts and Linux vendors have patched these old versions anyway, but many haven't.

If your site is on an old version, upgrading to PHP 8.2 or newer is the real fix. Don't flip the switch on a live business site without testing, though. Old plugins and custom code sometimes break on a newer PHP version. The safe order is:

1. Take a full backup.
2. Test the new PHP version on a staging copy of the site.
3. Click through the pages that make you money: contact forms, checkout, booking.
4. Switch the live site over once everything works.

If your host can't upgrade you and the server can't be patched, the honest advice from WordPress.org and the UK's National Cyber Security Centre is to take the site offline until it can be. A few hours offline costs far less than a hacked site.

A quick stopgap if the fix has to wait

If you manage your own server and need a few hours before you can update, one setting closes one of the attack paths. Set session.upload_progress.enabled = 0 in your PHP configuration and restart PHP. It's a temporary measure, not a replacement for the update. On shared or managed hosting, ask your host instead of changing server settings yourself.

The bigger lesson for site owners

Most WordPress security advice focuses on plugins, and that's fair, since plugins cause most hacks. But your site runs on a whole stack: the server, PHP, the database, WordPress, then your theme and plugins. A problem at any level can take you down.

This is a big part of what a proper website maintenance plan covers. Someone keeps an eye on security news, checks the server side and not just the dashboard, and chases the host when something like this lands. If you're weighing up whether that's worth paying for, my breakdown of website maintenance cost per month shows what's normally included.

For the technical details, the PHP Foundation's announcement explains both bugs, and the official PHP downloads page lists the current releases.

If you'd like me to check your site's PHP version and confirm the patch with your host, get in touch. It's a quick job, and you'll know for sure.