Blog
Critical PHP Security Update: What WordPress and Small-Business Site Owners Should Do
PHP released urgent fixes on October 21, 2026 for two critical flaws that can allow remote code execution. How to check your PHP version and what to do next.
On October 21, 2026, the PHP project released an urgent security update for two critical flaws that can allow an attacker to run code on a web server without logging in. If your website runs on WordPress or anything else built on PHP, this one is worth twenty minutes of your attention today.
The short version: Make sure your site runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer), or a version your host or Linux vendor has patched. Back up first, update WordPress and its plugins and themes while you're at it, and do a quick check for signs of tampering. If you're not sure how, ask your host.
What happened
The PHP team published a security advisory on php.net covering two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. In its advance notice the day before, PHP said both are rated CVSS v4.0 9.2, which is in the critical range. The public CVE records list the same score.
In plain English, the first flaw involves how PHP handles running out of memory partway through a request. The second involves leftover internal data from one request that a later request can wrongly reuse. PHP says either one can lead to unauthenticated remote code execution. That means someone on the internet could potentially run their own commands on your server without logging in.
The UK's National Cyber Security Centre published an alert, Critical security issue affecting PHP, encouraging organizations to take immediate action.
Why it matters for a small business
PHP runs behind a large share of small-business websites. WordPress is built on it, and so are many booking tools, online stores and contact-form plugins. According to PHP, the risk applies to all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers mod_php the highest risk and says it has a demonstrated exploit there, where an unauthenticated request can trigger the attack before any application code runs.
Let me be clear about what this doesn't mean. It doesn't mean every WordPress site has been hacked. The official sources I checked don't report widespread attacks, and the CISA assessment attached to the CVE records listed exploitation as "none" when it was published. But a flaw this serious tends to get attention quickly, so the time to update is now, before that changes.
The fixed versions
PHP 8.5: update to 8.5.12
PHP 8.4: update to 8.4.27
PHP 8.3: update to 8.3.36
PHP 8.2: update to 8.2.35. PHP says 8.2 reaches end of life on December 31, 2026, so plan a move to a newer version soon.
PHP says Linux distributions and long-term support vendors received the patches in advance, so a host may have patched your version without changing the number you see. PHP 8.1 and older no longer get updates from the PHP project. If you're on one of those, upgrade to a supported version, or ask your host or vendor whether they provide a backported fix.
PHP lists some temporary hardening settings for servers that can't be updated right away, but it's blunt about them: "There are no complete mitigations, updating is the only safe choice."
How to check your PHP version
You don't need to be technical for this. Use whichever applies to you:
WordPress: In your dashboard, go to Tools > Site Health, open the Info tab, and expand Server. The PHP version is listed there.
cPanel: Look for MultiPHP Manager in the Software section, which shows the PHP version for each domain. Some hosts offer Select PHP Version instead.
Plesk: Go to Websites & Domains, find your domain, and open PHP (sometimes shown as PHP Settings). The version is shown at the top.
Managed WordPress hosting: Many managed hosts handle PHP for you. Check their dashboard or status page, or just ask support whether your server has the October 21 PHP security fix.
If you see a version number lower than the ones listed above, don't panic. It may still be patched by your host. That's the question to ask them.
What I'd do this week
Back up first. Take a full backup of your files and database, and make sure it's stored somewhere other than the server itself.
Update PHP. Move to a fixed version in your hosting panel, or ask your host to confirm the patch is in place. If you're on 8.1 or older, this is the moment to upgrade.
Update WordPress core, themes and plugins. The PHP fix is the urgent part, but an older plugin may not run on a newer PHP version, so update everything together and test your key pages afterward: home page, contact form, checkout or booking.
Remove what you don't use. Deactivated plugins and old themes are still code sitting on your server.
Check for tampering. In WordPress, review Users and look for administrator accounts you don't recognize. Ask your host about recently modified files you didn't change, and run your host's malware scan if they offer one.
Change your logins if anything looks off, including WordPress admin, hosting and database credentials.
When to get help
Bring in your host or a developer if you can't find your PHP version, the update breaks your site, you're stuck on PHP 8.1 or older, or you find anything suspicious, like an unknown admin user or files you didn't change. NCSC's advice is to check for signs of compromise if you can't update immediately, and to get professional help if you aren't confident doing that yourself.
Most hosts can confirm the patch with a single support ticket. If you'd rather have someone handle the check, update and testing for you, get in touch and I'll help you work through it.