Published 25 October 2026
Website owners should check their active PHP version and ensure it is patched. On 21 October 2026, the PHP project released fixes for two critical vulnerabilities that could allow unauthenticated remote code execution. The fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The issue affects PHP installations serving web requests, including PHP-FPM, LiteSpeed, Apache with mod_php and php-cgi; it is not a WordPress-only problem. A WordPress update alone does not fix the PHP runtime.
If you manage your own VPS, arrange the relevant vendor update and restart affected PHP workers as required. If your site is on shared hosting, check the version actually serving the domain and ask your hosting provider to confirm patch status. Do not assume a version change has happened just because a control-panel setting looks different.
What changed in the PHP security release?
The PHP security advisory identifies two flaws: CVE-2026-109618, involving memory exhaustion and partially initialised request data, and CVE-2026-109619, involving stale internal state that may be reused by a later request. PHP describes the risk as applying to web-serving installations across several handlers and recommends updating; temporary configuration measures are not a complete substitute for a patched build.
The fixed version depends on the branch currently in use: PHP 8.5.12 for 8.5, 8.4.27 for 8.4, 8.3.36 for 8.3 and 8.2.35 for 8.2. Do not jump to another major or minor branch solely to address this advisory unless your application has been tested for compatibility. PHP 8.2 is also approaching its published end-of-life date of 31 December 2026, so sites on that branch should plan a tested move to a currently supported branch.
Important: PHP is the server-side runtime. Updating WordPress core, a plugin or a theme does not patch the PHP binary that processes requests.
How to check the PHP version used by your site
Check each production domain, including staging or secondary domains that run separate applications. In WordPress, open Tools > Site Health > Info > Server to view the PHP version reported for the site. On cPanel systems where the interface is available, MultiPHP Manager lists domains and their assigned PHP versions. Your hosting provider may restrict which versions customers can select, so a missing option does not necessarily mean the PHP release does not exist.
For VPS administrators, check the package and runtime used by the web-facing PHP handler—not only the command-line result of php -v. A server can have more than one PHP version installed, and command-line PHP may differ from the version configured for a website. cPanel documentation describes checking the domain in MultiPHP Manager or, with server access, using the domain’s virtual-host configuration.
Update safely: a practical checklist
- Record the active branch and handler. Note the domain, PHP version, and whether it uses PHP-FPM, LiteSpeed or another handler. If you run a VPS, identify the package source before updating.
- Back up and check compatibility. Take a restorable file-and-database backup, then review application and extension compatibility. For a store, include checkout, payment callbacks, order emails and scheduled tasks in the test plan.
- Apply the matching patched release. On a managed plan, contact the provider if the patched branch is not available or you cannot confirm it. On cPanel/WHM, the administrator may need to install or update the relevant PHP package through the server’s supported package-management tools.
- Restart or reload workers where needed. On a self-managed server, follow the package vendor’s service instructions so old PHP-FPM workers do not continue running the previous build. Shared-hosting customers should ask the provider whether this is handled server-side.
- Verify the live site and critical journeys. Recheck the PHP version through the site or hosting panel, then test public pages, login, forms, uploads and—where relevant—cart and checkout. Review PHP and application logs for new errors.
What if you cannot update immediately?
Ask the hosting provider for a clear answer: which patched PHP build serves your domain, when it was applied, and whether PHP workers were restarted. The PHP project lists temporary measures for specific attack paths, but explicitly says they reduce exposure rather than make an installation safe. Avoid copying server-wide configuration changes from a forum into a shared account; settings such as memory and upload limits can disrupt normal application behaviour, and some mitigations require administrator-level configuration.
If you run an older PHP branch, ask whether your operating-system or PHP vendor supplies a backported fix, and get confirmation for the exact package and handler. PHP says its project no longer updates PHP 8.1 and older, although some distributions and long-term-support vendors may provide backports. Treat “the site still loads” as a functionality check, not proof that the runtime is patched.
HostCupid perspective for site owners
For an Indian business website, the immediate task is straightforward: identify the PHP runtime behind every public application, confirm the relevant fix with the host or server administrator, then test the actions that bring enquiries or orders. HostCupid is a Chennai-based provider of shared and WordPress hosting, reseller services, website development and migration assistance. For a customer planning a hosting move or application upgrade, PHP branch and compatibility checks belong in the migration checklist—not as an assumption made after DNS has changed.
Use the official PHP advisory and your provider’s instructions as the source of truth. A careful version check, confirmed patch and focused post-update test are more useful than changing unrelated WordPress settings or waiting for a CMS update that cannot fix the runtime.
Sources
- PHP security advisory: Critical remote code execution vulnerabilities · 2026-10-21
- Critical PHP Security Release — WordPress News · 2026-10-21
- MultiPHP Manager for cPanel — cPanel & WHM Documentation
- PHP Supported Versions
