Urgent PHP Security Update: How to Check if Your WordPress Site Is Protected
On October 21, 2026, PHP released an urgent security update that fixes two critical flaws in the software almost every WordPress site runs on. Left unpatched, these flaws could let someone take control of a website without logging in. Here’s the short version: your site is protected if it runs PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a newer version in the same series. You can check in about a minute under Tools > Site Health > Info > Server in your WordPress dashboard. Some hosts, including WP Engine and Pantheon, are applying the fix for you. Others, especially shared hosting like GoDaddy, may need you to update PHP yourself. If your site is still on PHP 8.1 or older, there’s no official fix, so plan an upgrade now.
What Happened With PHP on October 21?
PHP is the programming language that powers WordPress behind the scenes. Your theme, your plugins and WordPress itself all depend on it.
The PHP team published a security advisory covering two vulnerabilities, each rated 9.2 out of 10 for severity. Both allow what’s called unauthenticated remote code execution. In plain terms, an attacker could run their own code on your web server without a username or password.
Because the problem lives in PHP itself, it doesn’t matter which theme or plugins you use. The PHP team is asking everyone to update right away, and is clear that temporary server tweaks reduce the risk but don’t replace the update.
How Do I Check My WordPress Site’s PHP Version?
- Log in to WordPress and go to Tools > Site Health.
- Click the Info tab, then open the Server section.
- Find the PHP version line and compare it to the table below.
| Your PHP version | What it means | What to do |
|---|---|---|
| 8.5.12+, 8.4.27+, 8.3.36+ or 8.2.35+ | Protected | Nothing urgent. PHP 8.2 stops getting security fixes after December 31, 2026, so plan a move to 8.3 or newer. |
| 8.2 to 8.5, but a lower number than above | Not patched yet | Ask your host when they’ll apply the October 21 PHP security update. |
| 8.1, 8.0 or anything starting with 7 | No official fix | Plan an upgrade to PHP 8.3 or newer as soon as possible. Back up and test first. |
What Is My Hosting Company Doing About It?
This is where your next step really depends on who hosts your site. Here’s what the hosts we work with most have told us:
- WP Engine: applying the patch automatically, and says it added protections at the network level before the official release. No action needed, but confirm your version in Site Health.
- Pantheon: rolling the patch out across its platform in waves, with no need to push anything from Dev to Live.
- Blackbaud Website Package (BBWP): servers already updated to PHP 8.3.36.
- GoDaddy and other shared hosting: you may need to change the PHP version yourself in your hosting dashboard.
- Self-hosted or IT-vendor-managed servers: timing depends on your vendor. Ask them directly when the October 21 patches will be installed.
What We Found When We Checked Our Clients’ Sites
The day the update came out, our team reviewed every WordPress site we support, grouped by hosting company. The pattern was clear: the more hands-off the hosting, the less our clients had to do.
- Managed hosts handled it. Sites on WP Engine, Pantheon and BBWP were patched by the host itself, with nothing for our clients to push or approve.
- Shared hosting needed hands-on work. One site we support on GoDaddy was still running PHP 7.4, which won’t get an official fix. GoDaddy requires a manual upgrade, so we’re testing the jump on the site’s development copy before touching the live site.
If your site falls in the second group, don’t assume someone else is on it. Check your version and ask.
Before You Upgrade From an Older PHP Version, Back Up and Test
Most PHP upgrades go smoothly, but we’ve sometimes seen them break things. The usual culprits are older plugins and themes that haven’t been updated in a while, and on a nonprofit site those can include the forms and embeds you rely on every day. A little prep goes a long way:
- Take a full backup of your site and database first.
- If your host offers a staging or development copy, test the new PHP version there before switching the live site.
- Update WordPress, your plugins and your theme before changing PHP.
- After the switch, click through your most important pages and forms: donate buttons, sign-up forms, event registration.
- Know how to switch back. Many hosts let you roll back to the previous PHP version if something breaks.
Need a Hand?
If you’d rather not deal with this yourself, we can check your site, talk to your host or handle the PHP upgrade for you. Get in touch and send us your site URL and who hosts it.
And if you’d like someone keeping an eye on surprises like this for you going forward, take a look at our monthly WordPress maintenance packages.
FAQ
Almost certainly, unless it already runs a patched version. The flaws are in PHP itself, so they affect WordPress sites regardless of theme or plugins.
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or any newer release in those same series. PHP 8.1 and older have no official fix.
Both are applying the patch automatically. It’s still worth confirming your PHP version under Tools > Site Health > Info > Server.
Plan an upgrade to PHP 8.3 or newer as soon as possible. Back up your site first and test on a staging copy if you can, since older plugins may need updating too.
