Two critical security vulnerabilities have been discovered in PHP, the programming language that powers WordPress and millions of other websites. On October 21, 2026, the PHP project released security updates to address these vulnerabilities.
If you manage a WordPress website, WooCommerce store, or another PHP-powered application, checking your PHP version and confirming that the security patches are installed should be a priority.
Important: Updating WordPress themes and plugins alone does not fix vulnerabilities in PHP itself. The underlying PHP runtime must be patched.
What Are the PHP Security Vulnerabilities?
PHP processes requests, runs application code, and generates dynamic content on web servers. WordPress relies on PHP to power its administration dashboard, themes, plugins, and website functionality.
The vulnerabilities described in the official security announcement affect PHP itself rather than a specific WordPress plugin or theme. Under certain circumstances, successful exploitation could allow an attacker to execute code remotely or expose sensitive information.
Because the PHP runtime is used by many applications, website owners should check all affected PHP installations, not just WordPress websites.
Read the official announcement: PHP security release, October 21, 2026.
Which PHP Versions Need Updating?
Check the official PHP security advisory for the affected branches and corresponding patched releases. The versions listed in the announcement are:
| PHP branch | Patched version listed in the advisory |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
If your website uses an earlier release, check with your hosting provider or server administrator about installing a security-fixed version. Older, unsupported PHP branches may require migration to a supported version.
Always verify the applicable fixed version against the official PHP advisory. Some operating system vendors backport security fixes, so version numbers alone may not always tell the full story.
How to Protect Your WordPress Website
1. Check Your Current PHP Version
- Log in to your WordPress dashboard.
- Navigate to Tools → Site Health.
- Open the Info tab.
- Expand the Server section.
- Check the PHP version reported for your website.
You can also check your hosting control panel or contact your hosting provider. Different websites, subdomains, and staging environments may use different PHP versions.
2. Confirm the Patch With Your Hosting Provider
Many hosting providers manage PHP updates for their customers. Contact your provider and ask:
- Has the relevant PHP security patch been installed?
- Is my website running a patched PHP release?
- Have all PHP handlers and application servers been updated?
- Do I need to take any additional action?
Do not assume that every website in your hosting account is protected just because a provider has announced that updates are underway. Confirm the status of your specific hosting environment.
3. Back Up Your Website Before Updating
Before changing server software or PHP versions, create a recent backup of your WordPress database, website files, uploads, and important configuration files.
Where possible, test the update on a staging website first. Check your website pages, WordPress dashboard, forms, login functionality, and important integrations after updating.
4. Check Every Website and Server You Manage
If you manage several websites for your business or clients, review each environment, including:
- Production websites.
- Staging and development websites.
- WooCommerce stores.
- Client websites.
- Subdomains and legacy applications.
- Virtual private servers and dedicated servers.
Pay particular attention to older websites that may be running unsupported PHP versions.
5. Keep WordPress Core, Themes, and Plugins Updated
Updating WordPress core, themes, and plugins does not fix vulnerabilities in the PHP runtime. However, keeping your WordPress installation and extensions up to date remains an important security practice.
Remove unused plugins and themes, use strong administrator passwords, enable multifactor authentication where available, and maintain regular backups.
6. Consider Web Application Firewall Protection
A web application firewall (WAF) can provide an additional layer of protection by detecting and blocking certain malicious requests.
Cloudflare has published information about protection for these PHP vulnerabilities through its managed WAF rules. If you use Cloudflare, review your security configuration and ensure that relevant protections are enabled.
A WAF is an additional safeguard, not a replacement for installing the appropriate PHP security patch.
Read more: Cloudflare PHP vulnerability protection announcement.
What Are Hosting Providers Doing?
PHP security updates require coordination between the PHP project, operating system vendors, hosting companies, and website administrators. These resources provide further guidance:
- GoDaddy: Important PHP security update
- WordPress.org security announcement
- Cloudflare security analysis
- The PHP Foundation announcement
Provider announcements may cover specific hosting products or environments. Confirm that your particular website and server have been secured.
Frequently Asked Questions
Do I need to update WordPress?
The immediate requirement is to ensure that the underlying PHP runtime has received the applicable security patch. Continue installing relevant WordPress core, theme, and plugin updates as part of your regular maintenance routine.
Will updating my WordPress plugins fix the issue?
No. Plugin and theme updates do not patch PHP itself. Your hosting provider or server administrator must ensure that the PHP runtime is updated.
My website is hosted on GoDaddy. Do I need to do anything?
Check your hosting account and confirm that your website is running a patched PHP release. If PHP is managed by GoDaddy for your hosting plan, contact its support team if the patch status is unclear. Remember to check any other hosting accounts you use.
What if I cannot update PHP immediately?
Contact your hosting provider or security administrator urgently and follow their recommended mitigation steps. A WAF may provide additional protection, but it does not replace the security update. If an internet-facing server remains vulnerable, ask a security professional whether temporary isolation is appropriate until it can be patched.
How can I tell whether my website has been compromised?
Installing a patch does not establish whether an earlier attack occurred. Review hosting and security logs for unusual activity, unexpected file changes, unfamiliar administrator accounts, suspicious requests, or unexplained server errors. If you suspect a compromise, investigate it rather than assuming that an update alone resolves the issue.
Final Checklist: Secure Your WordPress Website
- Identify every website and server that runs PHP.
- Check the PHP version and confirm that the relevant security patch is installed.
- Contact your hosting provider if the patch status is unclear.
- Back up your website and test its functionality after updates.
- Review firewall protection, access controls, and security logs.
- Plan migration away from unsupported PHP versions.
Website security depends on more than WordPress core and plugin updates. Maintaining the underlying server software is equally important.
If you manage a WordPress website, verify your PHP patch status today. A quick check with your hosting provider can help you identify remaining exposure and take appropriate action.
Official Security Resources
