The PHP security team has just released emergency fixes today (21st Oct 2026), for two critical vulnerabilities in PHP itself.
These flaws let attackers run code on your web server without logging in. Details of the flaws also leaked before the fix was ready, so attackers may already know how to use them.
If your WordPress site is running an unpatched version of PHP, then you need to update it right away.
Which PHP Versions Are Fixed?
The patched releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
If you’re on PHP 8.1 or older, your version no longer gets regular security updates, so you’ll need to upgrade to one of the versions above.
Keep in mind that updating WordPress core doesn’t change your PHP version. PHP runs on your hosting server, so the update happens in your hosting account or through your hosting provider.
What to Do Right Now
- Check your PHP version. In your WordPress dashboard, go to Tools » Site Health, click the ‘Info’ tab, and open the ‘Server’ section.
- Back up your site before you make any changes.
- Update to a patched version. You can usually switch PHP versions from your hosting dashboard. If you can’t find the setting, ask your host to update you to a patched release.
- Check for signs of a break-in. Updating stops new attacks, but it won’t remove a hacker who’s already in. Look for admin users you don’t recognize and files that changed unexpectedly.
👉 For step-by-step instructions, see our guide on how to update your PHP version in WordPress. It covers Bluehost, Hostinger, SiteGround, HostGator, DreamHost, and WP Engine, plus what to do if the update breaks your site.
If you can’t update right away, then reach out to your hosting provider and ask them to apply the fix for you.
Have a question or suggestion? Please leave a comment to start the discussion.