Critical PHP security update (21 October 2026): what WordPress website owners should do

Updated 22 October 2026 · 8 minute read

Quick answer: On 21 October 2026 the PHP project released a PHP security update (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) to fix two critical security flaws that can let an attacker run their own code on a web server without logging in. Almost every WordPress website runs on PHP, so the most important action is simple: ask your hosting provider to confirm your website is running one of these versions or newer. Below we explain what happened in plain language, which versions are safe, how to check your site in two minutes and what to do next.

What is PHP, and why does your website depend on it?

PHP is the programming language that WordPress is written in. Your website files sit on a server at your hosting company, and every time someone opens a page, the server runs PHP to build that page: it loads your content, your theme, your plugins and your contact forms.

You never see PHP directly, and on most hosting plans you do not manage it yourself. The hosting provider installs it and keeps it updated. That is exactly why a PHP security problem matters to every WordPress site owner, even if you have never touched the technical side of your website.

What happened in the 21 October 2026 PHP security update?

The PHP project gave advance notice on 20 October and published a security advisory on 21 October 2026 describing two vulnerabilities:

• CVE-2026-109618, a remote code execution flaw involving memory corruption.
• CVE-2026-109619, a remote code execution flaw involving leftover (stale) internal state.

Both are rated 9.2 out of 10 on the CVSS v4.0 scale, which is in the critical range. The advisory says they can allow unauthenticated remote code execution, and that every PHP installation serving web requests is at risk until it is updated. That includes the common ways hosts run PHP, such as PHP-FPM, Apache with mod_php and LiteSpeed, with the risk highest for mod_php.

What “unauthenticated remote code execution” means in plain terms

It sounds technical, but the meaning is simple and serious:

• Unauthenticated means the attacker does not need a username or password.
• Remote means they can do it over the internet, from anywhere.
• Code execution means they can make your server run their own instructions.

For a business website, that can lead to hidden spam pages, visitors being redirected to scam or gambling sites, malware being served to your customers, enquiry form data being stolen, or Google showing a warning next to your website. Cleaning up a hacked site usually takes far more time and money than keeping it updated.

Which PHP versions are safe?

A common trap: the version number has to be the fixed one for your branch. For example, 8.3.35 looks recent, but it is one release too old. The fixed version on that branch is 8.3.36.

How to check your website in two minutes

1. Log in to your WordPress dashboard.
2. Go to Tools → Site Health → Info and open the Server section.
3. Look for PHP version. Compare it with the table above.
4. Some hosting control panels also show the PHP version on the website’s settings page, usually under a name like “PHP configuration” or “Select PHP version”.

If your version is below the fixed version for its branch, or on 8.1 or older, contact your hosting provider.

What to ask your hosting provider

You do not need technical knowledge to get this sorted. A short message to your host’s support team is enough, for example:

“Hi, my website is yourdomain.com. Can you confirm it is running a PHP version patched for CVE-2026-109618 and CVE-2026-109619 (8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer)? If not, when will the update be applied?”

Many hosting companies and Linux vendors received the patches in advance and roll them out across their servers, but timing varies by provider, so it is worth asking rather than assuming.

What if the update cannot be applied straight away?

The PHP advisory lists some temporary server settings that reduce the risk while an update is being prepared. They are meant for server administrators, they must be applied at server level, and the PHP project is clear that they do not make an installation safe. On shared hosting, leave this to your host. Updating PHP remains the only real fix.

Don’t forget WordPress itself: version 7.1.3

Earlier this month, on 6 October 2026, WordPress released version 7.1.3 with seven security fixes and four bug fixes. They include a cross-site scripting issue on the Comments admin screen and an SQL injection issue in the WordPress export tool, and WordPress recommends updating immediately. Sites with automatic background updates enabled update on their own. Others need someone to click update in Dashboard → Updates.

PHP and WordPress are separate layers. A fully updated WordPress on an unpatched PHP version is still exposed, and the reverse is also true. Both need attention.

A simple monthly maintenance routine

Security issues like this appear several times a year. A short routine keeps your website in good shape:

1. Update WordPress, plugins and your theme, after taking a backup.
2. Keep backups outside the website, so you can restore it even if the server is compromised.
3. Remove plugins and themes you no longer use. Every unused plugin is extra code that can contain a weakness.
4. Check your PHP version every few months, and plan upgrades before a branch reaches end of life.
5. Review admin users and remove accounts that no longer need access.
6. Test your contact form and WhatsApp button, so you notice quickly if enquiries stop arriving.

Why this matters for small businesses

For many Malaysian SMEs the website is the first impression a new customer gets. A browser warning, a redirect to a strange website or a broken enquiry form can quietly cost you enquiries for weeks before anyone notices. Keeping PHP, WordPress and plugins updated costs far less than repairing a hacked website.

That is why DCraft packages include security maintenance in the yearly renewal, and our website maintenance plans add regular checks and updates for businesses that would rather have someone look after the website for them. If DCraft hosts your website, message us and we will confirm your PHP version.

Have a question about your own website? Ask the designer on WhatsApp. You will get a straight answer, not a sales script.

Frequently asked questions

Which PHP versions fix the October 2026 vulnerabilities?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project, so sites on those versions need to move to a supported version or get a patched build from their hosting vendor.

Can I update PHP myself in WordPress?

Usually not. On most hosting, PHP is updated by the hosting provider. You can check your version under Tools, Site Health, Info, Server, and some hosting panels let you switch between PHP versions. For the security fix itself, ask your host to confirm the patched version is installed.

Do I need to update WordPress for this PHP problem?

The PHP fix is applied on the server, not inside WordPress. Separately, WordPress released version 7.1.3 on 6 October 2026 with seven security fixes, so make sure WordPress, your theme and plugins are updated too.

How do I know if my website has been hacked?

Common signs are unknown admin users, pages or links you did not create, visitors being redirected to other websites, browser or Google warnings, and your hosting provider reporting malware. If you notice any of these, contact your developer or host straight away.

Sources

• PHP.net security advisory (21 Oct 2026)
• WordPress 7.1.3 maintenance and security release (6 Oct 2026)

Photo: Markus Spiske on Pexels