22 October 2026
The WordPress publishing platform issued an urgent notice to site owners on October 21, 2026, after the PHP project released security updates to patch two critical vulnerabilities. WordPress advises that the issue affects PHP servers hosting any application, including WordPress.
What Happened
PHP released fixes for two critical security vulnerabilities affecting all PHP hosting, including WordPress. The PHP team published patches October 18, and the new versions released are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. "These are very serious vulnerabilities", stated the PHP Foundation in a release. "The [PHP] project urges you to upgrade as soon as possible."
Why WordPress Site Owners Should Care
The vulnerabilities do not target WordPress itself. Rather, they affect the underlying scripting language that provides core functionality to millions of sites. "Although these vulnerabilities do not affect WordPress directly, they do affect all PHP applications, including WordPress," WordPress wrote in the advisory. The two vulnerabilities can enable attackers to execute arbitrary code, according to security researchers.
The PHP Foundation advises users to upgrade to the fixed PHP versions 8.5.12, 8.4.27, 8.3.36, 8.2.35 if they are running any of these major versions that were updated. WordPress adds this caveat to site owners: "It’s important to remember that these vulnerabilities exist within PHP itself and are not directly related to WordPress or its plugins."
What WordPress Recommends
WordPress advises site owners to check their PHP version first, and if they are on a fixed version, no immediate action is required but they should note the started patches. "If your PHP version is 8.2 or higher, you can verify the version by navigating to Tools > Site Health > Info > Server." With that check in, they should then:
1) Confirm if updates are planned from the web hosting provider
2) If an update is needed, complete it as soon as possible
More on this is available via StayAtCasinos.com.
The WordPress advisory notes that while some web hosts may already be deploying patches and WAF rules to mitigate exposure, site owners should still verify if their site has been remediated:.
Special Risk for Older Installations
PHP versions prior to 8.2 have ceased to receive security updates. This poses a higher risk of continued vulnerability. For self-managed servers running PHP 8.1 or earlier, WordPress advises weighing a temporary server shutdown for any site not yet updated to current levels.
"Why?"
The WordPress advisory cites guidance from the UK National Cyber Security Centre: "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."
In cases where a site relies on older PHP versions not fully patched, WordPress recommends noting the pending update and weighing options including offline maintenance until full remediation is complete.
Host and Mitigation Caveat
"_Web hosts may already be applying updates and WAF rules to mitigate vulnerabilities._ But site owners should still confirm remediation with their hosting provider.
The WordPress advisory rounds out with a reminder for site owners to "Note from your web host about any updates they've already applied, and give a shoutout if you update your site, too!"
