PHP's Emergency Security Fix: What It Means for Your WordPress Site

On October 21, 2026, the team behind PHP, the programming language WordPress runs on, put out an emergency security release. It fixes two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can let someone with no password run their own code on the server behind a website.

PHP's security advisory is plain about who is at risk: "all PHP installations serving web requests."

If your business website runs on WordPress, that includes yours, until your host installs the fix.

This is the plain-language version: what happened, how to tell whether you're covered, and what to do this week.

What Actually Happened

Most website security problems live in a plugin or a theme. This one doesn't. Both flaws are in PHP itself, the engine underneath every WordPress site. That is why it matters: a site can be exposed even when every plugin on it is up to date. The Hacker News reports the risk is highest on servers using Apache's mod_php setup, and that the flaws reach back to nearly every PHP version since 5.4.

The fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP's own release notes put it bluntly: "There are no complete mitigations, updating is the only safe choice."

Is anyone using the flaws yet? On the evening of October 21, researchers were reporting exploit attempts but no confirmed break-ins, and neither flaw was on CISA's list of vulnerabilities known to be exploited. That can change within hours. Treat it as urgent either way.

Old PHP Gets No Fix

PHP only patches versions it still supports. Here is where each version stands, from php.net:

• PHP 8.5: security fixes until December 31, 2029
• PHP 8.4: until December 31, 2028
• PHP 8.3: until December 31, 2027
• PHP 8.2: until December 31, 2026
• PHP 8.1: ended December 31, 2025
• PHP 8.0: ended November 2023
• PHP 7.4: ended November 2022

If your site runs on PHP 8.1 or older, no official fix is coming for these two flaws.

That is not a small group. WordPress.org's own numbers show about 36% of WordPress sites run PHP 8.1 or older, and 16% are still on 7.4. Another 24% are on 8.2, which runs out of support in about ten weeks.

Some hosts sell paid support for old PHP. GoDaddy, for example, adds a paid "PHP Extended Support" add-on at renewal to cPanel hosting plans still running a version PHP no longer supports. If you're on a plan like that, ask your host directly whether it covers these two new flaws, and ask what it costs to keep paying for a version the rest of the web has left behind.

How to Check Your PHP Version in Two Minutes

1. In WordPress: log in, go to Tools, then Site Health. Open the Info tab and expand Server. "PHP version" is listed there.
2. At your host: log in to your hosting account (cPanel, GoDaddy, Bluehost, SiteGround and others) and look for "PHP version" or "MultiPHP Manager."

If you can't log in to either one, that's worth knowing too. It means someone else controls your site, and you should find out who.

What to Do This Week

If you're on PHP 8.2, 8.3, 8.4 or 8.5: email your host one question: "Have you installed the October 21, 2026 PHP security release on my server?" Most shared hosts patch PHP themselves, but don't assume it. Get the answer in writing.

If you're on PHP 8.1 or older: move to 8.3 or 8.4. Do it carefully. Old themes and plugins can break on newer PHP, so:

• Back up the whole site, files and database, to somewhere outside your host before you change anything.
• Update WordPress, every plugin and your theme.
• Delete plugins you don't use. A deactivated plugin is still code sitting on your server.
• After every change, test the things customers touch: your contact form, your booking or inquiry form, your checkout. Those are the first things to break, and the last things anyone notices.

WordPress Itself Is Rarely the Problem

It's tempting to say every WordPress site is full of holes. That isn't true, and it isn't what the data says.

Patchstack, a WordPress security firm, counted 11,334 new vulnerabilities in the WordPress world in 2025, up 42% on 2024. 91% were in plugins and 9% were in themes. WordPress core had six, all low priority.

The risk is what's bolted on, and how long it goes without updates. In the same report, 46% of vulnerabilities had no fix from the developer by the time they were made public, and the most heavily targeted ones went from disclosure to mass attacks in a median of five hours.

WordPress core had six vulnerabilities in 2025. Plugins had over ten thousand. The risk is what's bolted on, and how long it goes without updates.

So here is the honest version. A lean WordPress site on a supported PHP version, with a few well-kept plugins and someone watching it, is a reasonable thing to own. A site built years ago and left alone since is a different story. This week's PHP release is a good reason to find out which one you have.

Fix It, or Replace It

We don't build new sites on WordPress (here's why). But plenty of good businesses run on it, and most of them don't need a rebuild this week. They need the site they have made safe.

So we offer two paths.

The WordPress Security Fix: $750, one time. We back up your whole site, move it to a supported PHP version with the October 21 fix, update WordPress, your plugins and your theme, remove what you don't use, and test your forms, bookings and checkout afterward. You get a one-page, plain-English report of what we found and what we changed. Most sites are done within a week.

Or a new site. If your site is too old to update cleanly, because the theme or key plugins were abandoned years ago, we'll tell you that straight. The $750 comes off any new site you start with us within 90 days. Sites start at $3,500.