Two critical PHP core vulnerabilities were patched on October 21, 2026. If you run PHP in production, you must update to the latest supported versions (8.5.12, 8.4.27, 8.3.36, or 8.2.35) immediately. Composer updates alone won’t fix this—your runtime must be patched.
Overview of the Incident
- Two critical RCE flaws (CVSS 9.2) were discovered in PHP, allowing attackers to execute code without authentication.
- Highest risk: Apache servers using mod_php, where malicious code can run before your site’s own code.
- Emergency patches released: October 21, 2026, at 14:00 UTC.
Fixed Versions
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
👉 If you’re on PHP 8.1 or older, those versions are end-of-life. Limited source fixes exist for 7.4, 8.0, and 8.1, but they don’t restore ongoing support.
Real-World Impact
Government sites in Netherlands and Finland went offline as a precaution.
CERT-EU and the UK National Cyber Security Centre advised temporary shutdowns where patching wasn’t immediately possible.
What Website Owners Should Do
Check your PHP version
In WordPress: Tools → Site Health → Info → Server.
Update immediately
Ask your host to install one of the patched versions. If using cPanel, confirm the PHP version includes the fix.
Upgrade unsupported versions
If you’re on 8.1 or older, arrange an upgrade. Vendor-provided fixes may help temporarily, but they’re not long-term solutions.
Precautionary steps
- If patching isn’t possible, consider taking your site offline with a 503 Service Unavailable page (Google-recommended).
- Use a WAF (e.g., Cloudflare) to block some attacks, but remember: firewalls are not substitutes for patches.
Post-patch checks
- Scan for web shells, unfamiliar admin accounts, or unexpected PHP file changes.
- A patch won’t remove existing compromises.
Why This Matters
- Attack tools were circulating before the patch was released, showing how quickly attackers move.
- A compromise can expose customer data and damage search visibility.
- The PHP Foundation admitted the delay in fixing one flaw was a “structural failure” and is now investing more in security processes.
Key Takeaway
If you’re running PHP in production—whether for WordPress or custom applications—update your runtime now. Don’t rely on plugin or Composer updates; they won’t patch PHP itself.