Last updated: October 26, 2026. This is a fast-moving story, so check the sources at the bottom for the latest details.
On October 21, 2026, the PHP project released emergency updates for two critical security flaws. If your website runs on WordPress, this affects you, even though the problem isn't in WordPress itself. WordPress is built on PHP, and an unpatched PHP can put your whole site at risk.
This guide explains what happened in plain language, how to check your site in about five minutes, and what to ask your hosting company.
The Short Version
PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities.
The flaws can let an attacker run code on a server without logging in.
Updating WordPress does not fix this. PHP is updated separately, and on most shared and managed hosting, your host controls it.
What you need to do: confirm that the PHP behind your site is patched, and that PHP was restarted after the update.
What Actually Happened
PHP's security team published an advisory for two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated critical, and PHP says they can allow unauthenticated remote code execution.
In simple terms, a specially crafted web request could trick a vulnerable PHP server into running an attacker's code. If that happens, the attacker could get the same access as your website: its files, its database credentials, and its data.
PHP's advisory says the risk applies to PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. That covers most WordPress hosting setups.
Is Your WordPress Site Affected?
Your site is likely affected if the PHP serving it is older than one of the fixed releases:
PHP branch
First fixed version
PHP 8.5
8.5.12
PHP 8.4
8.4.27
PHP 8.3
8.3.36
PHP 8.2
8.2.35
If you're on PHP 8.1 or older: the PHP project no longer releases updates for these versions. Some hosts and Linux vendors add their own fixes, so ask your host directly. If they can't confirm one, plan to move to a supported version.
One caution: some hosts apply security fixes without changing the version number. That's why checking the number alone isn't enough, and why you should ask your host (see below).
How to Check Your PHP Version in 5 Minutes
Log in to your WordPress dashboard.
Go to Tools → Site Health → Info.
Open the Server section.
Look for PHP version.
Compare it to the table above. If it's lower than the fixed version for its branch, or you're not sure, contact your host.
What to Ask Your Hosting Company
Send this message to your host, or paste it into their support chat:
"Is the PHP service that serves my website patched for CVE-2026-109618 and CVE-2026-109619, and has PHP been restarted since the update? Which exact PHP version and package revision is my site running?"
The restart matters. Running PHP processes keep using the old code until they're restarted, so an update that wasn't followed by a restart may not protect you yet.
If you manage your own server, update the PHP package, restart Apache, PHP-FPM, or whatever serves PHP, and rebuild containers from an updated image.
What If You Can't Patch Right Away?
The real fix is the update. PHP has published temporary mitigation settings, but they're incomplete, they can disrupt normal site features, and they don't replace patching. Government cyber agencies, including Canada's Cyber Centre, have urged affected organisations to update immediately, and the UK's NCSC has suggested considering taking systems offline if they can't be fixed quickly.
If a patch was delayed on your site, security vendors recommend keeping your web server, PHP, and firewall logs from about 48 hours before the October 21 release until the time PHP was patched and restarted, and reviewing them for unusual activity. A clean-looking log doesn't prove nothing happened, so ask your host or a security professional to help if you have any doubts.
What You Don't Need to Do
You don't need to reinstall WordPress. The flaw is in PHP, not in WordPress core, plugins, or themes.
A security plugin alone isn't enough. WordPress security plugins protect the application layer. PHP, the web server, and the operating system need their own updates.
Which PHP Version Should You Run After Updating?
This is a good moment to check where your site sits in PHP's support timeline:
PHP 8.1: reached end of life on December 31, 2025.
PHP 8.2: security support ends on December 31, 2026, so plan to move off it soon.
PHP 8.3: security support runs until December 31, 2027.
PHP 8.4: security support runs until December 31, 2028.
WordPress 7.0 raised the minimum supported PHP version to 7.4, and WordPress.org recommends PHP 8.3 or higher. PHP 8.4 is a strong choice if your theme and plugins support it.
Upgrade safely: back up your site, test the new PHP version on a staging copy first, update WordPress, your theme, and plugins, and check key pages and your checkout before switching the live site. Older plugins and themes are the usual cause of problems after a PHP upgrade.
Frequently Asked Questions
Do I need to update WordPress to fix this? No. Updating WordPress doesn't update PHP. The fix is a new PHP version or a patched PHP package from your host.
How do I know if my host has patched PHP? Check your PHP version in Site Health, then ask your host to confirm in writing that the fix is installed and PHP was restarted.
What is the best PHP version for WordPress in 2026? WordPress.org recommends PHP 8.3 or higher. PHP 8.4 is a good option for sites whose plugins and theme support it. Test on a staging site first.
Is PHP 8.3 stable for WordPress? WordPress recommends 8.3 or above, so it's a safe choice for most sites. Compatibility still depends on your specific plugins and theme.
Does this affect Shopify stores? Shopify stores aren't built on PHP, so this specific issue doesn't apply to them. WooCommerce and other WordPress-based stores do run on PHP and should be checked.
Should I worry if my site is on PHP 8.1 or older? Yes. The PHP project no longer releases fixes for those versions, so you need your host to confirm a vendor fix, or you should upgrade to a supported version.
Final Thoughts
The most important step is the simplest one: confirm with your host that PHP is patched and restarted. Then use this chance to move off any version that's reaching end of life.
If you'd like help checking your PHP version, testing an upgrade on staging, or keeping your WordPress site maintained, the team at Pixelscape can take care of it.
Sources
PHP security advisory: https://www.php.net/archive/2026.php
Canadian Centre for Cyber Security alert AL26-026: https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619
Help Net Security coverage: https://helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619
PHP supported versions: https://www.php.net/supported-versions.php
Top comments (0)