PHP security follow-up: what WordPress website owners should check with their host

Website technology follow-up · 26 October 2026 · Advisories published 21 October

The PHP Foundation announced fixes for two critical vulnerabilities in PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October. This follow-up focuses on the hosting checks behind the announcement, rather than treating it as new breaking news.

Check the runtime, not only the WordPress version

WordPress.org says the vulnerabilities are in PHP and are not specific to WordPress. Its advisory says no WordPress update is required or planned for these issues. Updating WordPress alone should therefore not be treated as confirmation that the PHP fixes are applied.

WordPress.org directs users to Tools → Site Health → Info → Server to see the PHP version where that information is available. The hosting control panel may also show it.

Ask your hosting provider

Confirm which PHP branch and patched package your site runs, who applies updates, and whether any action is needed from you. Follow the host’s current guidance; this article does not verify the patch status of an individual website.

Primary sources: PHP Foundation release explanation and WordPress.org security advisory, both dated 21 October 2026 and checked 26 October.

Browse more dated updates in World & Technology.