Critical PHP Security Release on 21 October 2026: What Website Owners Should Do

Update (22 October 2026): the fixes are out. See PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical RCE flaws for the fixed versions and what to do.

The PHP security team has announced a critical security release for Wednesday, 21 October 2026 at 14:00 UTC, fixing two vulnerabilities that are each rated CVSS v4.0 9.2. If your website runs on PHP, which includes WordPress, WooCommerce and most Pakistani business sites, you should prepare to update as soon as the patched version is available.

What PHP Has Announced

According to the official PHP announcement published on 20 October 2026:

• The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.
• It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.
• The team may release earlier if details become public or active exploitation appears.
• Affected and fixed versions will be published with the release, not before.

We do not yet know the technical details, so avoid trusting rumours or unofficial “fix” scripts. Rely on php.net and your hosting provider.

Why This Matters for Your Website

PHP runs on your server and processes every request to a dynamic site. A critical flaw in PHP itself can affect many sites at once, and attackers often start scanning for unpatched servers soon after details become public. Keeping PHP current is one of the most effective protections you have.

How to Prepare Today: 6 Steps

1. Back up your site. Save your files and database somewhere off the server. Our website backup guide shows how.
2. Find your PHP version. Check your hosting control panel or your WordPress Site Health screen (Tools → Site Health → Info).
3. Update WordPress, themes and plugins. Outdated or abandoned plugins are a common weak point and may also break on a newer PHP version.
4. Remove what you do not use. Delete inactive plugins, old themes and forgotten test sites.
5. Watch for the official release. Read the fixed versions on php.net when published, then plan the upgrade with your host.
6. Test after upgrading. Check your homepage, forms, checkout and admin login, and review error logs for problems.

If You Run a VPS or Dedicated Server

You are responsible for updating PHP yourself. Once patched packages are available for your operating system, apply them, restart your PHP and web services, and verify the new version. If you would rather not manage this, see our guide to choosing a VPS or consider managed WordPress hosting. On shared hosting, the provider normally handles server-level PHP updates, but you may still need to select the PHP version for your site, so confirm with your host.

Layered Protection Still Helps

Patching is the fix, but it should not be your only defence. Use strong passwords, keep an SSL certificate active, and read our overview of website security basics. Services like DDoS protection add another layer, though they do not replace updating PHP.

Frequently Asked Questions

When is the critical PHP security release?

The PHP security team scheduled the release for Wednesday, 21 October 2026 at 14:00 UTC. It may come earlier if details of the vulnerabilities become public or if active exploitation is seen.

How serious are the PHP vulnerabilities?

The PHP security team says the release addresses two critical vulnerabilities, each rated 9.2 on the CVSS v4.0 scale.

Which PHP versions are affected?

The advance notice does not list affected or fixed versions. Full details are to be published with the release, so check php.net once it is out.

What should I do before the PHP update?

Back up your website files and database, find out which PHP version your site runs, update WordPress, themes and plugins, and be ready to upgrade PHP as soon as your hosting provider makes the patched version available.

Questions About Your Site?

Not sure which PHP version your website uses or how to update it? Contact the Edish team and we will point you in the right direction.