Update, October 21, 2026: The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix both vulnerabilities. Read our new advisory for the fixed versions and what to do now.
Editor’s note: This post was published on October 20, 2026, before the PHP security release. On October 21, we updated it to point to our new advisory and to note that the fixes are now available. Other details reflect what was known at the time of publication.
The PHP security team has issued advance notice of an upcoming critical security release, scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern).
The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale.
PHP is the programming language WordPress is built on. Every WordPress site runs on a server with PHP installed, which means this release is relevant to every WordPress site owner, regardless of which plugins or themes they use.
The PHP team has not yet shared which versions are affected, what the vulnerabilities are, or which versions will contain the fix. Those details will be published with the release.
The team has also said it may ship the release earlier than scheduled if details of either vulnerability become public, or if it sees evidence of active exploitation.
UPDATE: The fixes are now available. Check which PHP version your site runs, and confirm your host has updated it or update PHP on servers you manage.
Why This Matters for WordPress Sites
PHP is not part of WordPress itself. It is server software, usually installed and managed by your hosting provider. That has two practical consequences:
- WordPress automatic updates will not apply this fix. Updating WordPress, your plugins, or your themes does not change the version of PHP your server runs.
- Who applies the update depends on how your site is hosted. On most managed and shared hosting, the host updates PHP for you. On a VPS, dedicated server, or any server you administer yourself, you or your developer are responsible for installing the update.
A CVSS score measures how severe a vulnerability is on a scale of 0 to 10, and 9.2 falls in the Critical range. We don’t yet know how these vulnerabilities can be triggered, so we can’t say how easily they could be used against a WordPress site. The update is now available, so apply it as soon as you can.
What We Know and What We Don’t
Confirmed by the PHP security team:
- A security release is scheduled for Wednesday, October 21, 2026 at 14:00 UTC.
- It addresses two critical vulnerabilities, each rated CVSS v4.0 9.2.
- The release may come earlier if vulnerability details become public or active exploitation is observed.
Not yet published: the affected PHP versions, the fixed version numbers, CVE identifiers, and technical details of either vulnerability. The release is now out: see our new advisory for these details.
How to Check Your PHP Version
In your WordPress dashboard, go to Tools > Site Health, open the Info tab, and expand the Server section. The PHP version your site is running is listed there. According to the PHP project’s supported versions page, these branches currently receive security fixes:
- PHP 8.5 and PHP 8.4: active support
- PHP 8.3: security fixes only, until December 31, 2027
- PHP 8.2: security fixes only, until December 31, 2026
If your site runs PHP 8.1 or older, it is on a version that no longer receives security fixes from the PHP project. The PHP project’s advisory says some Linux distributions and long-term support (LTS) vendors provide backported fixes, and the PHP security team has published minimal source backports for PHP 7.4, 8.0, and 8.1 for people who build PHP from source.
Ask your host about moving to a supported version, and test your site on that version first, because older plugins and themes can break on newer PHP.
What to Do Before the Release
- Find out who manages PHP on your server. If you use a hosting provider, check their status page or ask support whether they plan to apply the PHP security release and when. Many hosts update PHP automatically, but it’s worth confirming.
- If you manage your own server, plan a maintenance window for shortly after 14:00 UTC on Wednesday. If you install PHP from your operating system’s packages, a control panel, or container images, those updates may arrive on a different schedule from the official php.net release. Check with that source.
- Make a fresh backup of your site files and database before changing anything on the server, and confirm you can restore it.
- If you have a staging site, be ready to test the update there before applying it to your live site.
- Keep an eye on official channels. The php.net homepage will announce the release, and it may arrive early.
What Wordfence Is Doing
The Wordfence Threat Intelligence team is monitoring this release. Once the PHP team publishes details, we will review both vulnerabilities, assess how they could affect WordPress sites, and determine whether firewall protection is possible.
Some vulnerabilities in PHP itself can only be fixed by updating PHP, so updating your server remains the most important step whatever we find. The release is now out, and our new advisory covers the fixed versions and what to do next.
Wordfence Care and Wordfence Response customers can contact our incident response team if they need help. Wordfence Care includes incident response during business hours, while Wordfence Response provides 24/7/365 availability with a one-hour response time.
Learn more about Wordfence Care and Wordfence Response.
Timeline
- October 20, 2026: The PHP security team announced an upcoming critical security release addressing two vulnerabilities rated CVSS v4.0 9.2.
- October 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were released. See our new advisory.
Conclusion
The PHP security team will release a fix for two critical PHP vulnerabilities on Wednesday, October 21, 2026 at 14:00 UTC, or sooner if details leak or exploitation begins.
Because PHP runs underneath every WordPress site, this update matters to every site owner, and it won’t arrive through WordPress updates. Today, check which PHP version your site runs, confirm whether your host or your own team will apply the update, and take a backup.
When the release lands, apply it as quickly as you safely can. The release is now out. Read our new advisory for the fixed versions and next steps.
The post PSA: Upcoming Critical PHP Security Release appeared first on Wordfence.
