In this article
  1. What happened
  2. Who should care
  3. How to prepare today
  4. What we’ll watch

TL;DR: PHP’s security team says it will ship a security release on Wednesday, October 21, 2026, at 14:00 UTC, which is 10 p.m. Manila time. It fixes “two critical vulnerabilities, both rated CVSS v4.0 9.2.” PHP hasn’t said yet which versions are affected or which versions fix them, and it may release earlier if details of either flaw become public or there’s evidence of active exploitation. If you run a WordPress site or any other PHP app, find out your PHP version and who updates it today, so you can patch as soon as the fix is out.

What happened

PHP posted the advance notice on php.net on October 20, and Jakub Zelenka sent it to the php.announce mailing list at 19:33 UTC that day (October 21, 3:33 a.m. Manila). According to PHP:

  • When: the release is “scheduled for Wednesday, 21 October 2026 at 14:00 UTC.”
  • What: it “addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.”
  • What’s not public yet: “Full details, affected versions, and the fixed versions will be published with the release.”
  • It could come sooner: PHP says, “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”
  • What PHP asks: “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.”

When we checked, PHP’s releases list still showed 8.5.11, 8.4.26, 8.3.35 and 8.2.34, all from September 24, as the newest versions, so the fix isn’t out yet.

Who should care

Every WordPress site runs on PHP, including WooCommerce stores, and so do many other websites and web apps. WordPress recommends that hosts support “PHP version 8.3 or greater.”

PHP’s supported-versions page lists four branches that still get security fixes: 8.2 (until December 31, 2026), 8.3 (until December 31, 2027), 8.4 (until December 31, 2028) and 8.5 (until December 31, 2029). If your site runs PHP 8.1 or older, that branch isn’t on PHP’s supported list. In our view, you shouldn’t count on getting a fix for it, and today is a good day to plan the move to a supported version.

How to prepare today

  1. Find your PHP version. In WordPress, go to Tools > Site Health > Info and open the Server section. On a server you manage, run php -v. Your hosting control panel usually shows it too.
  2. Find out who patches it. On shared or managed hosting, your host updates PHP. Ask them, or check their status page, when they’ll roll out tonight’s release. If you run your own server or container, that job is yours.
  3. Take a backup now. Back up your site files and database before the release, so you can roll back quickly if an update breaks a plugin.
  4. Block out time after 10 p.m. Manila. If you patch yourself, plan to install the fixed version for your branch once PHP publishes it. Watch php.net’s news page or the php.announce list. For containers, update the base image tag and rebuild.
  5. Don’t guess at the details. PHP hasn’t named the affected versions yet. Treat posts that claim to know the bugs before the release as unverified.

If you’re updating servers today anyway, also see our story on eight compromised eMudhra certificate keys, which also asks you to update and rebuild server images.

What we’ll watch

We’ll update this story with the affected and fixed versions once PHP publishes the release.

Sources & method

Sources

Method. Last checked October 21, 2026, at 7:40 a.m. Manila time (October 20, 23:40 UTC). The schedule, the severity and the quotes come from PHP’s announcement and mailing-list post. Support dates come from PHP’s supported-versions page, and the current versions from PHP’s releases list. The preparation steps and the advice on old branches are our own judgment. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.