On 21 October 2026, PHP released an emergency fix for two critical security holes that let a stranger take over a web server without logging in. Attacks started the same morning. If your website runs on WordPress, WooCommerce, Drupal, Joomla or Laravel, it runs on PHP, and it needs this update now.
The good news: for most businesses the fix is one update that your hosting company applies. The job today is to make sure it has actually happened.
What happened, in plain English
PHP is the programming language that runs behind most websites. You never see it, but it’s what builds each page when someone visits. W3Techs counts PHP on about 69% of websites whose server language it can identify, and that includes every WordPress site.
On 20 October, PHP’s security team warned that an urgent fix was coming. Details leaked online the same day. On 21 October they released the fix, describing two flaws that “can allow unauthenticated remote code execution”. In plain English: someone with no password can make your web server run their own code. That’s the worst kind of website security hole. Both are rated 9.2 out of 10.
PHP’s own advisory says every PHP setup that serves web pages is at risk, and the risk is highest on the classic Apache setup many shared hosts use.
How seriously was it taken? In the Netherlands, government sites including DigiD, the national login, and MijnOverheid went offline as a precaution while the fix was prepared.
Security firms saw attack attempts on the morning of 21 October, before the fix was out. As of that day nobody had confirmed an actual break-in, but the details are public now, so it’s a matter of time. Don’t wait for confirmed cases.
WordPress itself does not need updating for this
The holes are in PHP, the engine underneath, not in WordPress. Updating WordPress or your plugins won’t fix it. What fixes it is your server running a patched version of PHP.
Which versions are safe
These versions, or newer, have the fix:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 or older gets no official fix at all. Those versions stopped receiving updates, so a site still on them stays exposed until it moves to a newer PHP. Plenty of small-business sites built a few years ago are exactly in that position.
Also worth knowing: PHP 8.2 stops getting security fixes on 31 December 2026, so if you’re on 8.2, plan the move to a newer version anyway.
What to do today
- Find out which PHP version your site runs. In WordPress, go to Tools → Site Health → Info → Server. It shows the PHP version. Your hosting control panel usually shows it too.
The version number can mislead you
Many hosts and Linux systems apply the fix without changing the version number you see. So a site showing an older number may already be safe, and a newer-looking number isn’t proof either. The reliable check is to ask your host whether the 21 October PHP security release has been applied to your server.
- Ask your host one question: “Has our server been updated to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or newer) for the 21 October security release?” Most good hosts are updating automatically, but ask, don’t assume.
- If you’re on PHP 8.1 or older, ask your host to move you to PHP 8.3 or 8.4. Test the site afterwards: very old themes and plugins sometimes need small fixes on a newer PHP.
- Don’t install “PHP fix” plugins or paste code snippets you find online. Some are useless, some are scams. The only real fix is the PHP update on the server.
- If you manage your own server, update now, then restart PHP-FPM or Apache: running PHP workers keep the old, vulnerable code until they restart. Linux distributions received the patch in advance, so check your vendor for updated packages, and look for the two CVE numbers (CVE-2026-109618 and CVE-2026-109619) in the package changelog.
If you use Cloudflare
Cloudflare has added protective rules for this, including on free plans. They help, but only as a stopgap, and only if your server accepts traffic exclusively through Cloudflare. They don’t replace the update.
Signs to watch for
While attacks are going on, keep an eye out for things that don’t look right: admin accounts you didn’t create, strange redirects, your site suddenly slow, warnings from your host, or spam being sent from your domain. If you see any of those, tell your host straight away and change your passwords.
How to not be here again
This is a good moment to check two things most owners never look at:
- Is your site on a supported PHP version? If it’s years old, it’s quietly missing security fixes all the time, not just this week.
- Does someone own updates? Hosting, PHP, WordPress and plugins all need updating regularly. If nobody’s job it is, it isn’t happening.
If you want a second pair of eyes, that’s the kind of thing we help with. A first check is free, and if your host has already patched you, we’ll simply tell you you’re fine.
Frequently asked questions
Do I need to update WordPress for the October 2026 PHP vulnerability?
No. The flaws are in PHP, the engine WordPress runs on, not in WordPress itself. Updating WordPress or plugins won't fix it. Your server needs PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, which is usually your hosting company's job.
How do I check which PHP version my website uses?
In WordPress, go to Tools, then Site Health, then Info, and open the Server section. Your hosting control panel usually shows it too. If you can't find it, ask your host.
What if my host hasn't updated PHP yet?
Ask them directly when they will, and keep the site's admin passwords strong in the meantime. If your site is behind Cloudflare, its protective rules help as a stopgap. If your host can't say when, it's worth moving to one that patches promptly.
My site shows an older PHP version number. Am I exposed?
Not necessarily. Many hosts and Linux systems add the fix without changing the visible version number. Ask your host whether the 21 October 2026 PHP security release has been applied to your server; that answer is more reliable than the number.
Is PHP 8.1 or older safe?
No. PHP 8.1 and older no longer get official security fixes, so they stay exposed to these flaws. Ask your host to move your site to PHP 8.3 or 8.4, then check that the site still works.
Is there a plugin that fixes this?
No. The only real fix is updating PHP on the server. Be wary of plugins or code snippets claiming to fix it; some are useless and some are scams.
Related reading: What to do when your web host goes down covers the other big hosting risk this month. Built your app with AI? Check it isn’t leaking customer data is about a different kind of exposure. And how much should a small business spend on a website includes what ongoing care should cost.
Sources: PHP security advisory, php.net (20–21 October 2026) · Patchstack · The Hacker News · Help Net Security · W3Techs · in-depth technical breakdown: HackingPassion. Last checked 22 October 2026.
Find this useful? Add us as a preferred source on Google and our posts will surface more often for you.
Changes only what you see in Google. Nothing is shared with us.
