The October 21, 2026 PHP security fixes are available. The first patched upstream releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ask your host to confirm that the fixed package is active on every serving instance. Updating WordPress or a security plugin does not patch the PHP runtime.
Confirm the Fixed Release for Your Branch
The PHP security advisory identifies CVE-2026-109618 and CVE-2026-109619, both capable of unauthenticated remote code execution. The affected web runtimes include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Do not assume that using FPM instead of Apache removes the need to patch.
| Upstream branch |
First fixed release for these two issues |
| PHP 8.5 |
8.5.12 |
| PHP 8.4 |
8.4.27 |
| PHP 8.3 |
8.3.36 |
| PHP 8.2 |
8.2.35 |
This is the October 21 fix baseline, not a claim that no later security updates exist. For distribution or LTS packages, use the vendor's advisory and package revision to verify a backport. PHP 8.1 and older are no longer supported upstream; obtain an explicit vendor-supported remediation path or migrate to a supported branch. Published source backports are not a reason to label an unpatched legacy installation safe.
WordPress's security notice confirms that these are PHP issues, not defects requiring a WordPress release. Check Tools > Site Health > Info > Server and your hosting provider's package evidence. Keep normal WordPress maintenance separate from this urgent runtime work.
Find the Person Who Can Actually Patch PHP
On managed hosting, ask the provider to confirm the deployment plan for your specific site or server pool. A general status-page statement is not the same as confirmation that your account is patched. On a VPS, the responsible person may be your server administrator, not the developer who updates plugins. Container deployments also need the running workload replaced, not only a new image built.
Open Tools > Site Health > Info > Server in WordPress and record the PHP version and server API. Do not publish the entire Site Health export: it can contain configuration details unrelated to the support request. The WordPress Site Health documentation explains this screen.
If you manage shell access, these read-only commands identify the command-line runtime:
php -v
php --ini
wp cli info
They do not prove which PHP process serves a browser request. Compare them with Site Health and the hosting configuration using our CLI versus web PHP diagnostic. Do not add an unrestricted public phpinfo page to gather evidence.
Send a Specific Hosting Request
Use this short checklist in your existing provider support channel:
| Ask the host |
Why it matters |
| Which PHP branch and package build serves this domain? |
A hosting account can contain several runtime pools. |
| Which advisory and package revision confirm both October 21 fixes? |
A version selector alone does not establish patch coverage. |
| When will the patched runtime be active? |
Downloaded packages are not necessarily running processes. |
| How will you verify all instances and scheduled workers? |
One healthy response can miss an old instance. |
| What is the contingency if deployment fails? |
Recovery must account for security exposure as well as uptime. |
Some distributions backport fixes without matching the upstream version string. In that case, request the vendor advisory and exact package revision that establishes coverage. Do not declare a host vulnerable solely because its base version looks old, or safe solely because it says PHP 8.
Patch verification has three separate checks: the provider identifies the fixed package, the serving processes use that build, and real site workflows still work. CLI version output alone does not prove the web runtime is patched.
Prepare Without Installing an Unverified Workaround
Check that backups include the files and database you would actually need to recover. Confirm access to the hosting console before the maintenance window. Keep the current theme, plugin list, PHP extensions and key integration requirements available so the administrator can distinguish a patch failure from an application compatibility issue.
CERT-EU now recommends immediate patching. If a fix cannot be applied promptly, have the responsible administrator assess isolating the exposed service until remediation is verified. Temporary configuration mitigations reduce specific attack paths but do not provide complete protection. A WAF rule alone is not a substitute for patching.
Do not change production PHP settings based on an unverified exploit explanation. If your host cannot provide a remediation plan, ask its security team to assess temporary access restrictions and the business impact with you. An ordinary WordPress maintenance screen is not proof that the PHP runtime is unreachable.
Verify the Service After the Patch
Record the deployment time, provider ticket and runtime evidence. Recheck each serving pool or instance through the host's supported method. Then test login, a representative page, media handling and the workflows that generate money or leads. For a store, use its approved test-payment procedure and verify the resulting order state without submitting a real charge.
Compare new PHP errors with the baseline. Check scheduled jobs as well as interactive requests. If there are signs of compromise, preserve evidence and involve incident response; patching closes a vulnerability but does not establish that an existing intrusion has been removed.
For a runtime change that breaks a form or checkout, get a scoped WordPress repair with the host ticket, package evidence and first relevant error. Do not automatically roll back to a vulnerable build just because the previous page rendered.
References reviewed October 22, 2026. Diagrams and test fixtures are explanatory, not customer results.