- The PHP security team will release a fix for two vulnerabilities, each rated 9.2 on CVSS v4.0, on October 21, 2026 at 14:00 UTC, or sooner.
- Wordfence says WordPress automatic updates will not apply it, because PHP is server software that the host or your own team manages.
- Before the release, confirm who owns PHP updates, check your PHP version, and take a tested backup.
A routine that stops one layer short
Most WordPress owners have a patching routine. The dashboard shows an update, and they click it or switch on automatic updates. Today that routine will miss a fix many of them will want.
On October 20, the PHP security team gave advance notice of a release due Wednesday, October 21, at 14:00 UTC, which is 10:00 AM Eastern. The release covers two vulnerabilities. Wordfence, a WordPress security vendor, relayed the notice. It says both flaws score 9.2 on CVSS v4.0, a severity scale that runs from 0 to 10.
This shows that patching is a question of ownership as much as speed. A fix can be ready and still sit unapplied because nobody is sure whose job it is.
Why WordPress can't deliver this one
WordPress is written in PHP, Wordfence notes. For any WordPress site to run, PHP must be installed on its server. That makes this release relevant to every site owner, whichever plugins or themes they use. Yet PHP is not part of WordPress. It is server software.
Think of a tenant and a landlord. The tenant can change the locks, but the building's wiring belongs to someone else. WordPress, plugins and themes are the tenant's side. PHP is the wiring.
Wordfence is explicit on the consequence. Updating WordPress, plugins or themes does not change the PHP version a server runs. The automatic update switch in the dashboard does not reach this fix.
Who does apply it depends on the hosting. On most managed and shared hosting, Wordfence says, the host updates PHP. On a VPS, a dedicated server or any server you run yourself, you or your developer must install it.
Timing is a further catch. Some sites get PHP from an operating system's packages, a hosting control panel or a container image. Those suppliers keep their own timetable, which may differ from the official php.net release. Wordfence advises asking that supplier directly.
What is still unknown
The PHP team has not said which versions are affected or which versions will carry the fix. It has not published the vulnerability details or CVE identifiers. Those will come with the release.
Wordfence says it does not yet know how the flaws can be triggered. Without that, it cannot say how easy an attack on a WordPress site would be. Even so, its guidance is to apply the update the moment it exists.
The date is not fixed. The PHP team reserves the option to release earlier if details of either flaw leak, or if attacks are seen in the wild.
One caveat on the source. Wordfence sells security services, including incident response plans. Its advice here is basic, though: update the server, and nothing in it depends on buying a product. Wordfence adds that some PHP flaws can only be fixed by updating PHP, whatever its own firewall research finds.
The older-version problem
Wordfence points to the PHP project's supported-versions page. It lists PHP 8.3 as receiving security fixes until December 31, 2027, and PHP 8.2 until December 31, 2026. Sites on PHP 8.1 or older are on versions that no longer get security fixes from the project.
Whether the flaws reach those older branches is unstated. Wordfence cautions against assuming that a retired branch will receive a fix. For a site on one of them, the answer may be a version upgrade, not a routine update.
That upgrade carries its own risk. Moving to a newer PHP can break older plugins and themes, Wordfence says. It advises trying the site on the new version first.
What to ask your team today
Wordfence's checklist translates into a few direct questions.
First, who updates PHP on our sites: the host or us? If it is the host, ask support whether and when it will apply the release. Wordfence notes many hosts update automatically but says to confirm.
Second, which PHP version do we run? The WordPress dashboard shows it on the Site Health screen, under the Info tab's Server section. Any site on 8.1 or older needs a separate conversation about upgrading.
Third, is there a fresh backup, and have we confirmed it restores? Wordfence advises taking one before any server change. If a staging site exists, test the update there first.
Fourth, who is watching php.net? The release will be announced there, and it may arrive early.
The fix is due at 14:00 UTC, possibly sooner, but the real test is whether anyone in your organization owns it. A patch moves only as fast as the person who has been given the job.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Wordfence.
