The PHP security team has released emergency fixes today, October 21, 2026, for two critical flaws that can let attackers run code on website servers without logging in.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 . PHP says updating is the only safe choice because no workaround fully addresses the vulnerabilities.

PHP says all installations serving website requests are at risk. Apache servers using mod_php , which runs PHP directly inside Apache, face the highest risk. A demonstrated attack can run before the website’s own code starts.

PHP runs WordPress on your web server. Updating WordPress or its plugins will not update PHP. Ask your host to install the fix.…