A critical PHP security release arrived on October 21, 2026. If you run WordPress, that is a good reason to check your hosting—even if you have never written a line of PHP yourself.
The fix belongs on the server, but the decisions around it are practical: identify your version, make sure the host patched it, check your backups, and test the parts of the website customers rely on.
Why PHP Matters Even if You Never Touch Code
PHP is the software language powering much of WordPress behind the scenes. You can write every page in a visual editor and still rely on PHP whenever somebody loads the site, sends a form, checks out, or signs in. That makes server updates a business concern, not merely an assignment for programmers.
On October 21 the PHP project reported fixes for two critical remote-code-execution vulnerabilities. The important phrase is remote code execution: under affected conditions, an attacker could cause a server to run code that the site owner never authorized. The official notice is urgent, but urgency should lead to a controlled update rather than clicking random links in unsolicited messages.
Find Out Which Version Your Website Uses
A WordPress administrator can often find the PHP version under Tools and Site Health, then the information tab. Managed hosting dashboards may show it as well. It is worth checking the actual server rather than assuming the version matches the one advertised in the hosting plan. A business may also have a staging site, a second account, or an older application using a different version.
Record each active site’s version and hosting provider. The October 21 advisory identifies patched versions including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Do not assume a version number from a different branch is newer in the way that matters. Ask the host which patched branch is running and whether the web server process has been restarted.
Talk to Your Host Before Changing a Live Store
An update may be available from a host control panel, but changing PHP can affect themes, plugins, payment gateways, and custom code. For a brochure site that may be inconvenient. For a store taking orders it can be expensive. Ask whether the host has applied the security fix, what the rollback process is, and how they handle compatibility testing.
If you are not comfortable doing those checks, let the host do the technical change. That is one service a managed hosting plan should provide. The best support response is specific: affected versions identified, upgrade applied, key pages tested, and a clear record of what was changed.
Make a Recovery Point First
Security updates are not an excuse to skip backups. Before a planned change, confirm that you have a recent database copy and a file backup that can actually be restored. A backup dashboard with a green check mark is less reassuring than a successful test restore on a separate environment.
Our WordPress hosting overview introduces the kinds of services a website owner may already be paying for. For a deeper process, WrightHost’s disaster recovery plan describes how to organize a recovery so a business can get back online without guessing.
Test What Customers Actually Use
After a PHP update, load the public home page, contact form, checkout if the site has one, account login, and at least one page that relies on a custom plugin. Check the error log if available. A working home page does not prove the payment gateway, form submission, or membership area still works.
If the site has a staging environment, test there first while coordinating an immediate security fix for the exposed production system. Do not let the desire for a perfect test plan become an excuse to postpone a critical patch indefinitely. Agree on the order of operations with whoever maintains the server.
Protect the WordPress Account Too
A patched runtime is only one piece of security. Weak administrator passwords, reused credentials, and overprivileged accounts can expose a site even when PHP is current. Give contributors only the permissions needed for their jobs and remove unused accounts.
A good companion step is adopting phishing-resistant account protection. Our plain-language passkeys guide explains what those credentials do and how to keep a recovery path. Administrative logins deserve special attention because a stolen account can turn an ordinary publishing tool into a source of unwanted changes.
Do Not Trust Update Emails at Face Value
A real security announcement creates an opening for fake urgent notices. An email telling you to click an unfamiliar download link or provide hosting credentials may be using legitimate news to push a scam. Open your known hosting control panel directly or contact your provider through a trusted support channel.
The same habit helps with QR-code scams, where a convincing printed label can hide an unsafe destination. A security message should tell you what to check, not force you to surrender your login to an unfamiliar site.
What to Do This Week
First, list the sites and versions you manage. Second, confirm the host has applied a fixed PHP release. Third, test login, forms, and commerce functions after the change. Fourth, check backups and note exactly where the restore files live. Finally, plan the next version upgrade before your current branch runs out of security support.
The PHP project’s October 2026 security advisory is the primary source for the affected releases and fixes. Keep it bookmarked so the next update decision comes from an official record, not a rumor spreading through social media.
An offline backup drive can complement hosted backups; a KingSpec 1TB NVMe SSD is one compatible-device-specific example, not a replacement for automated and tested backups.
Affiliate disclosure: qualifying purchases may generate a commission.