PHP Security Release on 21 October 2026: What WordPress Site Owners Need to Do

Last updated: 21 October 2026, 17:34 UTC. PHP has released the fix. We keep updating this post as hosting companies confirm their plans.

PHP, the language WordPress runs on, released an emergency security update on 21 October 2026. It fixes two critical vulnerabilities, both rated 9.2 out of 10, that can let an attacker run code on a server without logging in. Details leaked before the fix, and early attacks were reported before it came out.

That sounds alarming, and it is serious. But for most WordPress site owners the fix sits with their hosting company, not with them. This post explains what is going on, how to tell whether you need to do anything, and where to get help if you do.

What is the PHP vulnerability?

The PHP security team has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix CVE-2026-109618 and CVE-2026-109619. PHP says both can allow unauthenticated remote code execution and asks all PHP users to update immediately.

What PHP and security researchers have confirmed:

• The flaws are in PHP itself, below the level of WordPress, plugins, or themes. Keeping WordPress updated does not protect you here.
• WordPress.org confirms that no WordPress update is required or planned for these issues. The fix is the PHP update alone.
• Every PHP installation that serves web requests is at risk, however PHP runs on the server (PHP-FPM, Apache with mod_php, CGI, FrankenPHP or LiteSpeed). That means nearly every WordPress site.
• PHP rates the risk highest on servers running Apache with mod_php, where an attacker can trigger the flaw before WordPress even loads.
• Cloudflare reported early attacks on the morning of 21 October, before the fix was released.
• The PHP project only releases updates for PHP 8.2 and newer. If your site runs 8.1 or older, see the section on older versions below.

Mattias Geniar keeps a running technical summary of what is confirmed and what is not, if you or your developer want the detail.

Is your WordPress site affected?

Yes, unless the fix has already been applied. Every PHP version before 8.5.12, 8.4.27, 8.3.36 and 8.2.35 is affected, and so is PHP 8.1 or older unless your host or vendor has added the fix. The more useful question is who has to act, and that depends on how your site is hosted.

Start by checking which PHP version your site runs. In your WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. The PHP version is listed there. Most hosting control panels show it as well.

Write that number down. One caution: many servers install PHP from their Linux distribution, which often applies the fix without changing the version number you see. So an older-looking number does not always mean your site is unpatched. If in doubt, ask your host whether they have applied the 21 October PHP security release.

What should you do, based on your hosting?

Managed WordPress hosting. If your site is with a managed WordPress host, such as Kinsta, WP Engine, Pressable, or WordPress VIP, the host updates PHP across its servers. You do not need to change anything. Check your host’s status page or email for confirmation, and contact their support if you have not heard anything by the end of the day.

Shared hosting. On shared hosting, typically a plan with a cPanel or similar control panel, the host runs PHP for everyone on the server and will roll out the patched version. Watch for their notice. Many panels also let you choose your PHP version yourself, which matters if you are still on 8.1 or older. If you are unsure, ask your host directly whether they have applied the 21 October PHP security release.

A VPS or a server you manage yourself. If your site runs on a cloud server (DigitalOcean, Linode, AWS, Hetzner and similar) through a tool like Ploi, Forge, or RunCloud, or on a server you set up yourself, nobody is going to patch it for you. Whoever manages that server needs to install the updated PHP packages now and restart PHP, so every worker runs the fixed version. If the server installs PHP from the volunteer-run Remi repository, PHP warns that it will not have updates today, so the fix has to come from another source. This is the group that needs to act today.

Package sources updated at different speeds. Ubuntu’s own packages and Ondřej Surý’s packages (sury.org, which also backports the fix to PHP 8.1 and older) are now available. The volunteer-run Remi repository has said it will not have updates today. If apt or yum does not offer the update, check which source the server installs PHP from, and use the interim steps below until the fix arrives.

Your site is behind Cloudflare. Cloudflare has deployed firewall rules against these attacks on every plan with its web application firewall, including the free one. On the free plan they are on automatically. On Pro, Business and Enterprise plans, check that Cloudflare’s managed rules are set to block, not only to log. Treat this as a layer, not a fix: Cloudflare itself says customers should still update PHP, and attackers can sometimes reach the server directly and skip Cloudflare.

What if your site runs PHP 8.1 or older?

The PHP project no longer releases updates for PHP 8.1, 8.0, 7.x or older. Some Linux distributions and paid long-term support vendors add fixes to older versions, and PHP published minimal fixes for 7.4, 8.0 and 8.1 for people who build PHP themselves. For most sites, though, the real way out is to move to a supported PHP version, which means 8.2 or newer.

WordPress.org and the UK’s National Cyber Security Centre go further: if you manage your own server and cannot upgrade PHP right away, consider taking the site offline until you can.

That is usually straightforward, but not always. Older themes and plugins can break on a newer PHP version, and on a live store a broken checkout costs money. The safe route is to test the upgrade on a staging copy first, fix whatever breaks, and then switch the live site. If your host is forcing the upgrade today, take a full backup first and check the key pages and forms right after.

What if you cannot update right away?

Update anyway, as soon as you can. PHP is clear that only the update is a complete fix, and for most site owners that means making sure your host has applied it.

If a server cannot be updated today, PHP lists measures that reduce exposure to specific attack paths but do not make an installation safe. The main ones:

• Set session.upload_progress.enabled = 0 in the PHP or server configuration and restart PHP. PHP confirms this blocks one attack path for CVE-2026-109619. WordPress does not use this feature, so turning it off should not affect a typical site.
• Remove PHP’s memory limit at server level and keep the upload size limit low. This narrows CVE-2026-109618 but does not close it, and it needs a server-level memory limit in its place, so it is a job for whoever runs the server.

PHP’s announcement lists the exact settings for server administrators. If you are on shared or managed hosting, ask your host rather than editing server settings yourself.

Rather not touch server settings yourself? A Codeable expert can install the PHP update, apply these settings safely where an update has to wait, and check that uploads and forms still work afterwards. Hire an expert to protect your site.

What hosting companies have said so far

Codeable experts and our technical operations team are in direct communication with major hosting providers and infrastructure partners.

The ones we are in touch with have confirmed that they are actively tracking the release, monitoring traffic anomalies, and preparing automated mitigations.

What hosts and platforms have said or shown so far, as of 17:34 UTC:

• SiteGround (official): says its clients are protected at server level and do not need to change settings or PHP versions. The statement was published before PHP released the fix.
• Pressable (official): says all Pressable sites are already protected against both vulnerabilities, on every PHP version and including staging sites. No action needed.
• WP Engine (official): its status page reports protection at the CDN level (Cloudflare and Fastly) while PHP updates roll out across all customer platforms.
• Pantheon (official): rolling out the fixed PHP versions across its infrastructure.
• Flywheel (official): protection at the CDN level while updates roll out.
• DreamHost (official): protections in place on all hosting platforms, ready to deploy the updated PHP.
• Liquid Web (official): deploying security updates across affected systems.
• Rocket.net (official): PHP maintenance in progress.
• OVHcloud (official): firewall rules on all web hosting clusters, with the fix deploying through 22 October.
• Kinsta (official notice to customers): no action needed. Kinsta is rolling out interim protections and deploying the fixed PHP versions once validated, and emails users with Company or Site access when a site is patched. Our experts are already seeing updated versions on some Kinsta sites.
• RunCloud (reported by our experts): the control panel is in maintenance mode while RunCloud updates PHP. Once it is back, check that your servers are on the fixed version.
• SpinupWP (reported by our experts): the automatic PHP updates have completed.
• GoDaddy (official): published an advisory asking customers to check their PHP versions, move off 8.1 or older, and update. It does not say what GoDaddy patches on its side, so GoDaddy customers should confirm with support that their site runs a fixed PHP version.
• Laravel Forge and Laravel Cloud (reported, quoting Laravel’s notice): Laravel Cloud patches PHP automatically. On Laravel Forge, customers update the PHP version themselves from the server’s Forge dashboard.
• Cloudways (official): its status page reports a phased rollout of the official patches across its servers since the late afternoon, and says it uses extended long-term support partners for outdated PHP versions. It has not yet confirmed which servers are done.
• Namecheap (official): its status notice says all affected services are now mitigated and the final PHP patches are being applied, with no completion time yet.
• CloudLinux (official): the operating system behind many cPanel shared hosts publishes its updated PHP packages after the official release, so on many shared hosts the fix arrives a little later. Meanwhile its Imunify360 firewall rules block the public exploit on Apache servers, but on LiteSpeed servers they only log it.
• Unlimited Web Hosting (UK) (official): is applying interim protections across shared and reseller hosting and will update PHP once its vendors ship packages.
• Uberspace (reported): switched PHP off entirely as a precaution from 15:45 CEST while it patches, according to heise.
• Register.it (reported by our experts): PHP has already been updated.
• Plesk (official): has released the fixed PHP 8.2 to 8.5 for servers running Plesk, with patches for PHP 8.0 and 8.1 in development.
• cPanel-based hosting (reported): hosts that use cPanel are waiting for cPanel to publish its updated PHP packages, so the fix may reach them later than managed hosts. InMotion Hosting has finished its dedicated servers, is updating VPS, and protects shared hosting while it waits.
• Netcup (official): took its web hosting and managed servers offline as a precaution while it patches. Testing of the patched PHP versions passed in the evening and rollout to all web hosting servers is under way. Netcup will also patch older PHP versions itself, and says customer data is not at risk.
• Cloudflare (official): firewall rules against these attacks are on for every plan with its web application firewall, including the free one.

We are currently tracking patch status across major hosting providers and will update this section as official maintenance schedules are published.

When to bring in a WordPress expert

Codeable is a WordPress-only expert platform, and our experts can take this off your plate if you are not sure where your site stands or cannot make the change yourself.

That covers checking how your site is hosted and whether it is still exposed, installing the patched PHP release on a VPS, applying the interim settings safely, upgrading a site from an unsupported PHP version with testing on staging first, and checking the site afterwards for any sign it was hit before the patch.

If you already work with a Codeable expert, reach out to them directly. Otherwise, our WordPress security experts work from one fixed price agreed before any work starts, built on the $80–$120 hourly expert rate, and completed project work carries a 28-day bug-fix warranty.