An important security alert affects thousands of websites and online stores that run on PHP. On October 21, 2026, the language’s security team announced fixes for two critical vulnerabilities, which, under certain conditions, could allow remote code execution without a prior user login.
Which versions have been patched?
According to the official announcement, PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 include the fixes. The two vulnerabilities have been flagged as particularly severe, and PHP maintainers recommend an immediate upgrade. The PHP 8.2 series is also nearing the end of its support period, which is set for December 31, 2026.
PHP is the server-side language powering many content management systems and e-commerce sites. A visitor can view a normal website without knowing which version the server running it is using.
Why does this apply to WordPress?
WordPress is built on PHP. However, this does not mean that every WordPress website is equally vulnerable: the actual risk depends on the PHP version, how it is executed, and the server configuration. The announcement explicitly mentions environments such as PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed, with particular emphasis on certain configurations.
Upgrading WordPress or plugins does not replace upgrading PHP. These are different levels of the system. If the server remains on a vulnerable version, updating the theme or WordPress is not enough to address the specific issue.
What a website owner needs to do
- Check with the hosting provider to see which version of PHP the site is running.
- Ask whether the patched version of the same supported series has been installed or if an upgrade is scheduled.
- Request a backup and a quick compatibility check of critical plugins, the theme, and the checkout process before making any production changes.
- After the change, they test forms, user login, e-shop orders, and the admin panel.
- If an outdated or unsupported version is being used, they organize a secure migration to a supported version.
What Not to Do
Do not blindly change server settings or carelessly install files from unknown sources. If there is a system administrator or hosting company, the upgrade must be performed by an authorized person familiar with the specific installation. This is the right balance between security and business continuity.
The Conclusion
This announcement concerns truly critical vulnerabilities in the infrastructure and is not a routine plugin alert. Administrators do not need to panic, but they do need to check their server’s version and develop a secure upgrade plan today.
Original source: PHP.net, Security Advisory 10/21/2026 · WordPress.org News.