PHP security update set to fix two critical 9.2 flaws
A PHP security update scheduled for Wednesday, October 21, 2026, will address two critical vulnerabilities beneath every WordPress website. The PHP security team plans to publish the release at 14:00 UTC, or 10:00 AM Eastern. Each vulnerability has a score of 9.2 under CVSS v4.0, the Common Vulnerability Scoring System used to rate security flaws from 0 to 10.
PHP is the programming language used to build WordPress, and it runs as software on the server hosting the website. That makes the forthcoming release relevant to every WordPress site owner, irrespective of the plugins or themes installed. The PHP security team has not yet disclosed which PHP versions are vulnerable, which releases will contain the corrections, how either flaw can be triggered, or the related CVE identifiers. A CVE is a standard public identifier assigned to a documented security vulnerability.
The team may release the update before the scheduled time if technical details become public or evidence of active exploitation appears. There is currently nothing for site owners to install, and the absence of technical information means it is not yet possible to say how easily either vulnerability could be used against a WordPress website. What owners can do now is establish who controls PHP for their site and make sure that person or provider is ready to act when the fixed versions are announced.
This update will not arrive through WordPress itself. PHP is server software rather than a component included in WordPress, so installing WordPress core, plugin or theme updates will not change the PHP version used by the server. On most shared and managed hosting services, the hosting provider maintains PHP. On a VPS, or virtual private server that the customer administers, a dedicated server, or another self-managed system, the owner or developer is normally responsible for installing the update.
Site owners can find their current version by opening the WordPress dashboard and selecting Tools, Site Health, Info, then Server. The installed PHP version appears in that section. According to the PHP project's supported-versions information, PHP 8.5 and PHP 8.4 are in active support. PHP 8.3 receives security fixes only until December 31, 2027, while PHP 8.2 receives security fixes only until December 31, 2026.
PHP 8.1 and earlier releases no longer receive security fixes from the PHP project. The security team has not said whether the newly disclosed vulnerabilities affect those older branches, but unsupported versions should not be expected to receive a correction. Owners of sites using PHP 8.1 or earlier should ask their host about moving to a supported branch. That migration should be tested first because older WordPress plugins and themes can stop working correctly with newer PHP versions.
Customers of a hosting provider should check its service-status page or contact support to ask whether it will apply the PHP security update and when. Many hosts update PHP automatically, but owners should confirm rather than assume. Administrators responsible for their own servers should plan a maintenance window shortly after 14:00 UTC on October 21, while also watching for an earlier release.
Updates obtained through an operating system's software packages, a hosting control panel or container images may follow a different schedule from the official release on php.net. A container image is a packaged copy of software and its required environment. Administrators using one of these distribution methods should check when their particular supplier will make the corrected PHP build available.
Before changing PHP, create a fresh copy of the site's files and database, the structured store containing WordPress content and settings, and verify that the backup can be restored. Sites with a staging site, meaning a separate test copy that visitors do not use, should install and test the update there before changing the live website. The php.net homepage is expected to announce the release, including if it arrives ahead of schedule.
Wordfence says its Threat Intelligence team is monitoring the planned release. After the PHP security team publishes the missing technical details, Wordfence intends to assess how the vulnerabilities could affect WordPress and whether firewall protection is possible. A firewall is software that examines traffic and can reject harmful requests. Wordfence also cautions that some flaws inside PHP can be resolved only by updating PHP, making the server update the primary response regardless of whether firewall rules are feasible.
Wordfence plans to add affected and corrected versions to its analysis after publication. Its Care customers can seek incident-response assistance during business hours, while its Response service provides 24/7/365 availability with a one-hour response time.
For owners who prefer the hosting layer to be provided as a managed service, AEU Hosting offers managed WordPress hosting secured end to end. Regardless of hosting arrangement, the immediate priorities are to identify the current PHP version, confirm who will deploy the PHP security update, prepare a tested backup and apply the corrected release as quickly as compatibility checks safely allow.