> PSA: Upcoming Critical PHP Security Release

The PHP security team has issued advance notice of an upcoming critical security release, scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern). The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale. PHP is the programming language WordPress is built on. Every WordPress site runs on a server with PHP installed, which means this release is relevant to every WordPress site owner, regardless of which plugins or themes they use. The PHP team has not yet shared which versions are affected, what the vulnerabilities are, or which versions will contain the fix. Those details will be published with the release. The team has also said it may ship the release earlier than scheduled if details of either vulnerability become public, or if it sees evidence of active exploitation. There is nothing to install yet. What you can do today is find out who is responsible for updating PHP on your site, and make sure that update can happen quickly once the release is available. Why This Matters for WordPress Sites PHP is not part of WordPress itself. It is server software, usually installed and managed by your hosting provider. That has two practical consequences: WordPress automatic updates will not apply this fix. Updating WordPress, your plugins, or your themes does not change the version of PHP your server runs. Who applies the update depends on how your site is hosted. On most managed and shared hosting, the host updates PHP for you. On a VPS, dedicated server, or any server you administer yourself, you or your developer are responsible for installing the update. A CVSS score measures how severe a vulnerability is on a scale of 0 to 10, and 9.2 falls in the Critical range. We don’t yet know how these vulnerabilities can be triggered, so we can’t say how easily they could be used against a WordPress site. Treat this as an update to apply as soon as it is available. What We Know and What We Don’t Confirmed by the PHP security team: A security release is scheduled for Wednesday, October 21, 2026 at 14:00 UTC. It addresses two critical vulnerabilities, each rated CVSS v4.0 9.2. The release may come earlier if vulnerability details become public or active exploitation is observed. Not yet published: the affected PHP versions, the fixed version numbers, CVE identifiers, and technical details of either vulnerability. We will update this post when the release is out. How to Check Your PHP Version In your WordPress dashboard, go to Tools > Site Health, open the Info tab, and expand the Server section. The PHP version your site is running is listed there. According to the PHP project’s supported versions page, these branches currently receive security fixes: PHP 8.5 and PHP 8.4: active support PHP 8.3: security fixes only, until December 31, 2027 PHP 8.2: security fixes only, until December 31, 2026 If your site runs PHP 8.1 or older, it is on a version that no longer receives security fixes from the PHP project. The PHP team has not said whether these vulnerabilities affect older versions, but unsupported versions should not be expected to receive a patch. Ask your host about moving to a supported version, and test your site on that version first, because older plugins and themes can break on newer PHP. What to Do Before the Release Find out who manages PHP on your server. If you use a hosting provider, check their status page or ask support whether they plan to apply the PHP security release and when. Many hosts update PHP automatically, but it’s worth confirming. If you manage your own server, plan a maintenance window for shortly after 14:00 UTC on Wednesday. If you install PHP from your operating system’s packages, a control panel, or container images, those updates may arrive on a different schedule from the official php.net release. Check with that source. Make a fresh backup of your site files and database before changing anything on the server, and confirm you can restore it. If you have a staging site, be ready to test the update there before applying it to your live site. Keep an eye on official channels. The php.net homepage will announce the release, and it may arrive early. What Wordfence Is Doing The Wordfence Threat Intelligence team is monitoring this release. Once the PHP team publishes details, we will review both vulnerabilities, assess how they could affect WordPress sites, and determine whether firewall protection is possible. Some vulnerabilities in PHP itself can only be fixed by updating PHP, so updating your server remains the most important step whatever we find. We will update this post with affected versions, fixed versions, and our analysis as soon as the information is available. Wordfence Care and Wordfence Response customers can contact our incident response team if they need help. Wordfence Care includes incident response during business hours, while Wordfence Response provides 24/7/365 availability with a one-hour response time. Learn more about Wordfence Care and Wordfence Response. Timeline October 20, 2026: The PHP security team announced an upcoming critical security release addressing two vulnerabilities rated CVSS v4.0 9.2. October 21, 2026, 14:00 UTC: Scheduled release of the PHP security update. Conclusion The PHP security team will release a fix for two critical PHP vulnerabilities on Wednesday, October 21, 2026 at 14:00 UTC, or sooner if details leak or exploitation begins. Because PHP runs underneath every WordPress site, this update matters to every site owner, and it won’t arrive through WordPress updates. Today, check which PHP version your site runs, confirm whether your host or your own team will apply the update, and take a backup. When the release lands, apply it as quickly as you safely can. We will update this post as soon as the PHP team publishes the affected and fixed versions. The post PSA: Upcoming Critical PHP Security Release appeared first on Wordfence.