The PHP security team has just released emergency fixes today (21st Oct 2026), for two critical vulnerabilities in PHP itself.

These flaws let attackers run code on your web server without logging in. Details of the flaws also leaked before the fix was ready, so attackers may already know how to use them.

If your WordPress site is running an unpatched version of PHP, then you need to update it right away.

Which PHP Versions Are Fixed?

The patched releases are:

PHP 8.5.12

PHP 8.4.27

PHP 8.3.36

PHP 8.2.35

If you’re on PHP 8.1 or older, your version no longer gets regular security updates, so you’ll need to upgrade to one of the versions above.

Keep in mind that updating WordPress core doesn’t change your PHP version. PHP runs on your hosting server, so the update happens in your hosting account or through your hosting provider.

What to Do Right Now

Check your PHP version.…