PHP critical security release, October 2026: what it means for your WordPress site (live updates)

Live updates. Last updated: 21 October 2026, 05:40 UTC.

php.net has announced a critical PHP security release for Wednesday 21 October 2026 at 14:00 UTC. It fixes two vulnerabilities, both rated CVSS v4.0 9.2. Every WordPress site runs on PHP, so treat your sites as potentially affected until the advisory says otherwise.

Here's the short version:

• Details, affected versions, and fixed versions come out with the release. php.net hasn't published them yet.
• PHP 8.2, 8.3, 8.4, and 8.5 are the versions php.net currently supports. It's not yet clear whether PHP 8.1 and older will get the patch, because php.net hasn't shared that yet.
• We're preparing to patch the Wordify platform as soon as fixed builds are available, during an emergency maintenance window. Follow the status page.
• If your site is on PHP 7.4, 8.0, or 8.1, move it to PHP 8.2 or newer now.

We'll keep this post updated as things happen. See Live updates for the latest, newest first.

What we know

On 20 October 2026, the PHP security team gave advance notice of an upcoming security release. Here's what they've said:

• When: Wednesday 21 October 2026 at 14:00 UTC.
• What: Two critical vulnerabilities, both rated CVSS v4.0 9.2.
• Details: Full details, affected versions, and fixed versions will be published with the release.
• Reported CVE IDs (not yet confirmed by php.net): CVE-2026-109618 and CVE-2026-109619. These IDs are circulating in industry reports but haven't appeared in php.net's announcement or the CVE database yet. We'll confirm or correct them when the advisory is published.
• Timing could change: php.net may release earlier if details of either vulnerability become public, or if there's evidence of active exploitation.

What we don't know yet: which PHP versions are affected, what the vulnerabilities do, or their confirmed CVE numbers. We won't guess. We'll add them here once php.net publishes them.

What it means for your WordPress site

WordPress is written in PHP, so every WordPress site depends on the PHP version underneath it. Until the advisory names the affected versions, assume any WordPress site could be in scope.

The version your site runs matters most. According to php.net's supported versions page, only PHP 8.2, 8.3, 8.4, and 8.5 are still supported. PHP 8.1, 8.0, and 7.4 have reached end of life:

It's not yet clear whether PHP 8.1 and older will get the patch. php.net hasn't shared which versions are affected or which will be fixed, and we'll update this post once it does. Moving to PHP 8.2 or newer now means you don't have to wait to find out.

What Wordify is doing

• We're aware of the release and preparing to patch the platform as soon as fixed builds are available.
• We'll run an emergency maintenance window so we can apply the fixes safely. Check our status page for live status.
• We'll update this post as the release lands and as our work progresses.

What you should do

1. Check your site's PHP version. In the Wordify dashboard, open the site, then under Hosting select PHP. You'll see the version the site is running.

2. If it's on PHP 7.4, 8.0, or 8.1, upgrade to PHP 8.2 or newer now. Don't wait for the advisory. Moving now means your site is on a version that's still supported when the fixes arrive.

On Wordify, PHP version changes use PHP Safe Updates. We check the site first, make the switch, clear the caches, and keep watching. If the new version breaks the site, we put the previous version back automatically and email you what happened. For most sites, that email includes the error WordPress reported, which usually points to the plugin or theme to update. To change version:

1. Open the site, then under Hosting select PHP.
2. Choose the new version and click Save.
3. Confirm in the dialog. Safe Update is on by default.

A tip on which version to pick: PHP 8.2 is supported until 31 December 2026, so if your plugins and themes support it, PHP 8.3 or newer gives you longer before your next upgrade.

Need a hand? Our support team is here 24/7.

Common questions

I'm on PHP 7.4, 8.0 or 8.1. Will I get the fix?

php.net hasn't yet shared which versions will get the security fix. We'll update this post once the advisory is out. Until then, the safest move is to upgrade to PHP 8.2 or newer.

Will there be downtime?

Patching PHP is routine maintenance for us. We can't promise exact timings yet, but we expect to apply the patch with very little downtime. Our status page has live updates.

Can you just upgrade my site to the latest PHP?

Not automatically. Some sites run plugins or themes that don't support PHP 8.2 or later yet, so a forced upgrade could break them. When you change version yourself, PHP Safe Updates checks the site as it switches. If your site isn't compatible, we put the previous version back and email you what happened. For most sites, that includes the error WordPress reported, which usually points to the plugin or theme to update.

Live updates

All times are UTC. Newest first.

Coming up, 21 Oct 14:00 UTC: php.net is due to publish the release, including the affected versions, fixed versions, and CVE IDs. We'll add the details here as soon as they're out, including what they mean for PHP 8.1 and older. For platform status, see our status page.

21 Oct 05:40 UTC: Industry reports are citing CVE-2026-109618 and CVE-2026-109619 for these vulnerabilities. php.net hasn't confirmed them yet, and the CVE records aren't public. We'll update this post when the advisory is out.

21 Oct 03:00 UTC: php.net has announced the release; details due 14:00 UTC.