Critical PHP vulnerability alert: On 21st October 2026, the PHP security team released emergency fixes for two critical flaws in PHP itself. The four PHP versions that currently provide patches are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. If your WordPress site runs an unpatched version of PHP, update it right away. Updating WordPress or your plugins will not fix this.
Yes, if your server runs an unpatched PHP version. Two critical PHP flaws let attackers run code on your web server without logging in. Details of the flaws also leaked before the fix was ready, so attackers may already know how to use them. Check your PHP version and update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
The PHP security team has fixed two critical vulnerabilities in PHP itself. This is a server-level problem, so it does not come from a theme, a plugin or WordPress core.
Because of this, a WordPress site on an unpatched PHP version is at real risk and should be updated immediately.
Many site owners assume that clicking “Update” in the dashboard is enough. Here it is not. Updating WordPress core does not change your PHP version. PHP runs on your hosting server, so the update happens in your hosting account or through your hosting provider.
These are the patched releases that fix the two critical PHP flaws:
| PHP Branch | Patched Version |
|---|---|
| PHP 8.5 | PHP 8.5.12 |
| PHP 8.4 | PHP 8.4.27 |
| PHP 8.3 | PHP 8.3.36 |
| PHP 8.2 | PHP 8.2.35 |
If you’re on PHP 8.1 or older, your version no longer gets regular security updates. You need to upgrade to one of the patched versions listed above.
If you can’t update right away, reach out to your hosting provider and ask them to apply the fix for you. Hosts such as Bluehost, Hostinger, SiteGround, HostGator, DreamHost and AWS Lightsail let you manage PHP versions from the hosting account. If the update breaks your site, restore your backup and ask your host for help.
Updating PHP stops new attacks, but it won’t remove a hacker who’s already in. After you patch, check your site for:
If you find either, treat the site as a hacked WordPress site and clean it up. Don’t assume the PHP update alone solved it.
Two critical PHP flaws allow code to run on your server without a login, and their details leaked before the fix was ready. Your WordPress and plugin updates won’t protect you from a server-level PHP flaw. Check your version, back up, update PHP to a patched release and look for signs of a break-in today.
Check out more details about vulnerability and security advisory on cert website and on php official website.
Trying to stay on top of it all? Get the best tools, resources and inspiration sent to your inbox every Wednesday.
