The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale.
PHP is the programming language WordPress is built on. Every WordPress site runs on a server with PHP installed, which means this release is relevant to every WordPress site owner, regardless of which plugins or themes they use.
The PHP team has not yet shared which versions are affected, what the vulnerabilities are, or which versions will contain the fix. Those details will be published with the release.
The team has also said it may ship the release earlier than scheduled if details of either vulnerability become public, or if it sees evidence of active exploitation.
There is nothing to install yet. What you can do today is find out who is responsible for updating PHP on your site, and make sure that update can happen quickly once the release is available.
Why This Matters for WordPress Sites
PHP is not part of WordPress itself. It is server software, usually installed and managed by your hosting provider. That has two practical consequences:
WordPress automatic updates will not apply this fix. Updating WordPress, your plugins, or your themes does not change the version of PHP your server runs.
Who applies the update depends on how your site is hosted. On most managed and shared hosting, the host updates PHP for you. On a VPS, dedicated server, or any server you administer yourself, you or your developer are responsible for installing the update.
A CVSS score measures how severe a vulnerability is on a scale of 0 to 10, and 9.2 falls in the Critical range. We don’t yet know how these vulnerabilities can be triggered, so we can’t say how easily they could be used against a WordPress site. Treat this as an update to apply as soon as it is available.
What We Know and What We Don’t
Confirmed by the PHP security team:
A security release is scheduled for Wednesday, October 21, 2026 at 14:00 UTC.
It addresses two critical vulnerabilities, each rated CVSS v4.0 9.2.
The release may come earlier if vulnerability details become public or active exploitation is observed.
Not yet published: the affected PHP versions, the fixed version numbers, CVE identifiers, and technical details of either vulnerability. We will update this post when the release is out.
How to Check Your PHP Version
In your WordPress dashboard, go to Tools > Site Health, open the Info tab, and expand the Server section. The PHP version your site is running is listed there. According to the PHP project’s supported versions page, these branches currently receive security fixes:
PHP 8.5 and PHP 8.4: active support
PHP 8.3: security fixes only, until December 31, 2027
PHP 8.2: security fixes only, until December 31, 2026
If your site runs PHP 8.1 or older, it is on a version that no longer receives security fixes from the PHP project. The PHP team has not said whether these vulnerabilities affect older versions, but unsupported versions should not be expected to receive a patch.
Ask your host about moving to a supported version, and test your site on that version first, because older plugins and themes can break on newer PHP.
What to Do Before the Release
Find out who manages PHP on your server. If you use a hosting provider, check their status page or ask support whether they plan to apply the PHP security release and when. Many hosts update PHP automatically, but it’s worth confirming.
If you manage your own server, plan a maintenance window for shortly after 14:00 UTC on Wednesday. If you install PHP from your operating system’s packages, a control panel, or container images, those updates may arrive on a different schedule from the official php.net release. Check with that source.
Make a fresh backup of your site files and database before changing anything on the server, and confirm you can restore it.
If you have a staging site, be ready to test the update there before applying it to your live site.
Keep an eye on official channels. The php.net homepage will announce the release, and it may arrive early.
What Wordfence Is Doing
The Wordfence Threat Intelligence team is monitoring this release. Once the PHP team publishes details, we will review both vulnerabilities, assess how they could affect WordPress sites, and determine whether firewall protection is possible.
Some vulnerabilities in PHP itself can only be fixed by updating PHP, so updating your server remains the most important step whatever we find. We will update this post with affected versions, fixed versions, and our analysis as soon as the information is available.
Wordfence Care and Wordfence Response customers can contact our incident response team if they need help. Wordfence Care includes incident response during business hours, while Wordfence Response provides 24/7/365 availability with a one-hour response time.
October 20, 2026: The PHP security team announced an upcoming critical security release addressing two vulnerabilities rated CVSS v4.0 9.2.
October 21, 2026, 14:00 UTC: Scheduled release of the PHP security update.
Conclusion
The PHP security team will release a fix for two critical PHP vulnerabilities on Wednesday, October 21, 2026 at 14:00 UTC, or sooner if details leak or exploitation begins.
Because PHP runs underneath every WordPress site, this update matters to every site owner, and it won’t arrive through WordPress updates. Today, check which PHP version your site runs, confirm whether your host or your own team will apply the update, and take a backup.
When the release lands, apply it as quickly as you safely can. We will update this post as soon as the PHP team publishes the affected and fixed versions.
Search
Trust Your Site
to the Leader in WordPress Security
Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.
Our business hours are 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays.
Response customers receive 24-hour support, 365 days a year, with a 1-hour response time.
This website uses cookies, pixels, and similar technologies (collectively “Cookies”) to improve your browsing experience. By clicking “Accept All”, you agree to the storing of Cookies on your device and that we may share, track, store, and analyze your interactions with the website to enhance site navigation, analyze site usage, and assist in our marketing efforts. For more information on our use of cookies please review our Cookie Policy.
Cookie Settings Accept All Reject All
Cookie Options
For additional information on how this site uses cookies, please review our Privacy Policy. The cookies used by this site are classified into the following categories and can be configured below.
Strictly Necessary
Always active
The “Strictly Necessary” cookies are necessary for the Sites and Services to work properly, and cannot be disabled. They include any essential authentication and authorization cookies for the Services. If you select the “Reject All” button, or choose to do nothing, only the strictly necessary cookies are active by default.
Functional
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These cookies allow us to remember choices you make, such as your username, language, or region. This helps provide a more personalized and consistent experience by tailoring the Services to your preferences. For example, we can remember your preferred settings or login details, so you don't have to re-enter them each time you visit.
Performance/Analytical
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These Cookies allow us to collect certain information about how you navigate the Sites or utilize the Services running on your device. They help us understand which areas you use and what we can do to improve them.
Targeting
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These Cookies are used to deliver relevant information related to the Services to an identified machine or other device (not a named or otherwise identifiable person) which has previously been used to visit our Sites. Some of these types of Cookies on our Sites are operated by third parties with our permission and are used to identify advertising sources that are effectively driving customers to our Sites.
Cancel Save
Do Not Sell or Share My Personal Information
This form enables you to request that we stop selling or sharing your personal information with third parties. "Selling" includes exchanging your information for money or other benefits, while "sharing" refers to providing your data to third parties for targeted advertising purposes. For more information on how we process personal information, please review our Privacy Notice.
When you submit this form, we will:
Immediately disable retargeting and remarketing cookies on your current browser/device
Browser/Device Specific: This opt-out applies to the specific browser from which you submit the request. To opt out on additional devices or browsers, you will need to submit separate requests.
Cookie Management: You may also manage cookies directly through your browser settings, or on our Cookie Control form.
Do Not Sell or Share My Personal Information
Stop selling personal information about me to third parties for monetary or other valuable consideration.
Stop sharing personal information about me with third parties for cross-context behavioral advertising.
Your request has been received. We will no longer share or sell your personal information on this browser.
Cancel Submit
An error occurred while attempting to submit your request. Please try again or contact support.
Alex Thomas
