On 20 October 2026, the PHP security team gave advance notice of a security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It fixes two critical vulnerabilities, both rated 9.2 on CVSS v4.0.
PHP runs a large share of the web, including WordPress, WooCommerce, Magento, Drupal, Laravel and many custom business applications. If any of your websites, web apps or servers run PHP, plan to update as soon as the fixed versions are available.
What PHP has announced
- The release is scheduled for 21 October 2026 at 14:00 UTC.
- It addresses two critical vulnerabilities, each rated CVSS v4.0 9.2.
- Full details, the affected versions and the fixed versions will be published with the release.
- PHP may release earlier if details of either vulnerability become public, or if there is evidence of active exploitation.
At the time of writing, PHP has not published technical details. Some security researchers have reported that the flaws allow remote code execution, but PHP has not confirmed this. We will update this article when the release is out.
Who is affected?
Until PHP lists the affected versions, treat every PHP installation as one that may need updating. That includes shared hosting, VPS and dedicated servers, cloud instances, Docker images and managed platforms.
PHP's most recent security releases, on 24 September 2026, covered the 8.2, 8.3, 8.4 and 8.5 branches (8.2.34, 8.3.35, 8.4.26 and 8.5.11). PHP 8.1 and older have reached end of life and no longer receive security fixes from the PHP project. If you are still on one of them, plan an upgrade rather than a patch.
What to do now, before the release
- Find every PHP version you run. Run
php -von each server, check your hosting control panel, and look at the PHP base images in your Dockerfiles and CI pipelines. The command line and the web server can use different versions, so check both. - Check that each one is on a supported branch (8.2 to 8.5).
- Back up your files and databases, and make sure you can restore them.
- Prepare a staging copy where you can test the update before it reaches your live site.
- Book a maintenance window and agree who will apply the update.
- Ask your hosting provider whether they patch PHP for you, and when.
How to patch once the fix is out
- Install the fixed version from your usual source: your operating system's packages, your hosting control panel, the official PHP Docker image, or php.net.
- Linux distributions such as Ubuntu, Debian and Red Hat often backport security fixes without changing the PHP version number. Check your distribution's security notice rather than relying on the version number alone.
- Restart PHP-FPM and your web server so the patched version is actually running. For containers, rebuild and redeploy your images.
- Confirm the running version on every server and site.
- Test your important pages, forms, checkout and admin login.
- Watch your server and application logs for unusual requests over the following days.
If you cannot update straight away
Patch as soon as you can. Until then, reduce your exposure: restrict access to admin areas, keep your web application firewall rules up to date and monitor your logs closely. These steps lower the risk but do not replace the update.
How WebCastle can help
Our team can find which PHP versions your websites and servers use, apply the security update, test your site afterwards and move older applications to a supported version of PHP.
Need help patching your website or servers? Contact us, email sales@webcastle.com or call +1 617-982-2043, and our team will help you get your sites and servers updated.
Frequently asked questions
When will the PHP security fix be released?
It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. PHP may publish it earlier if details of the vulnerabilities become public or if they are being actively exploited.
Which PHP versions are affected?
PHP will publish the affected and fixed versions with the release. Until then, check every system that runs PHP and be ready to update it.
Does this affect WordPress websites?
WordPress runs on PHP, so the PHP version on your server needs the update. Updating WordPress, themes or plugins alone does not fix a vulnerability in PHP itself.
I am on PHP 7.4 or 8.1. Will I get a fix?
These versions are past end of life and no longer receive security fixes from the PHP project. The safest option is to upgrade to a supported version of PHP.
Source: PHP security release announcement on php.net, 20 October 2026.
