Two critical flaws in PHP, the software that runs your website on the server, let an attacker run their own code on that server without logging in. Emergency fixes were released on October 21, 2026. PHP says updating is the only safe choice, because no workaround fully addresses the flaws, so the action is simple: ask your host to install the fix today.
PHP says all installations serving website requests are at risk. Apache servers using mod_php, which runs PHP directly inside the Apache web server, face the highest risk, and a demonstrated attack can run before your site’s own code starts. If your site is WordPress, updating WordPress, your theme or your plugins does nothing here. WordPress runs on PHP, and PHP is separate.
The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Four steps
- Check what you are running. In WordPress, open Tools > Site Health, select Info, and expand Server.
- Ask your host to install a patched version. If your hosting account lets you switch PHP versions through cPanel, confirm the version you select includes the patch.
- If you cannot patch immediately, discuss taking the site offline until it can be updated, and ask your host to show a maintenance page with an HTTP 503 response, which tells Google the outage is temporary. A web application firewall such as Cloudflare may block some attempts, but it is not a substitute for the fix. If you use a firewall, make sure every visit passes through it, because an attacker who reaches your server directly goes around those checks.
- After patching, check for web shells (malicious scripts that give attackers access), unfamiliar admin accounts, and unexpected changes to PHP files. A patch does not remove a compromise that already happened.
Older PHP versions
PHP 8.1 and older are end of life and no longer get regular official updates. For this emergency, PHP released limited source-code fixes for 7.4, 8.0 and 8.1 for teams that build PHP themselves, and your host or a long-term support vendor may supply its own update. None of that restores ongoing support. Ask your host to confirm you are protected while you arrange a move to a supported version.
Move quickly. There are reports of an attack tool circulating before this patch was out, and the fix only protects you once it is installed. Agree with your host now, in writing, on who applies emergency patches and who decides to take a site offline, so you are not negotiating that during the next one.
