WordPress.org Warns Site Owners After Critical PHP Security Release

WordPress.org on October 21, 2026, highlighted a PHP security release that fixes two critical vulnerabilities affecting servers that run PHP applications. In its notice, WordPress.org said site owners should update PHP as soon as possible and check with their web host for available updates.

The notice makes clear that this is not a WordPress software issue. No WordPress update is required or planned for these vulnerabilities.

What changed

The PHP project announced a security release to address two critical security flaws in PHP. Because the issues are described as critical, WordPress.org urged site owners to act quickly, even if their hosting company may already be applying updates or adding web application firewall rules to reduce risk.

WordPress.org also noted that the problem affects any server hosting a PHP application, not just WordPress sites. It added that PHP versions earlier than 8.2 no longer receive security updates from the PHP project.

What it means for your website

If your WordPress site runs on PHP, this matters even though WordPress itself does not need a patch. The main question is whether your hosting environment has already been updated, and whether your site is still running a supported PHP version.

For business owners, this is mostly a hosting and server maintenance issue, but it still needs attention. WordPress.org says you can check your PHP version in Tools > Site Health > Info > Server, and many hosts also show this in the hosting control panel.

What to do now

• Check which version of PHP your site is using in WordPress under Tools > Site Health > Info > Server, or in your hosting panel.
• Ask your web host whether it has already applied the PHP security update or added WAF rules to help mitigate the vulnerabilities.
• If an update is available through your host or server management tools, update PHP as soon as possible.
• If your site is on a PHP version earlier than 8.2, treat it as a higher risk because those versions no longer receive security updates from the PHP project.
• If you manage your own hosting and your server is on a version earlier than 8.2, consider taking the server offline until you can update it. WordPress.org cited national cyber security agency advice that systems should be taken offline when immediate remediation is not feasible.