Last updated: October 26, 2026. This is a fast-moving story, so check the sources at the bottom for the latest details.

On October 21, 2026, the PHP project released emergency updates for two critical security flaws. If your website runs on WordPress, this affects you, even though the problem isn't in WordPress itself. WordPress is built on PHP, and an unpatched PHP can put your whole site at risk.

This guide explains what happened in plain language, how to check your site in about five minutes, and what to ask your hosting company.

The Short Version

PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities.

The flaws can let an attacker run code on a server without logging in.

Updating WordPress does not fix this.…