PHP security update: what does it mean for your WordPress website?

On 21 October 2026, the PHP team released a security update for two critical vulnerabilities in PHP. The update had been announced a day earlier. CERT-EU, the cybersecurity team of the European institutions, has also published an advisory about it.

The fix is included in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older PHP versions no longer receive updates from the PHP team. The PHP team recommends updating as soon as possible.

WordPress is the system you use to manage your website. Under the hood, WordPress runs on PHP. That is the programming language the server uses to build your pages as soon as a visitor opens them. You never see PHP itself, but your website cannot do without it.

The vulnerabilities are in PHP, the technology underneath WordPress, and not in WordPress itself, your theme or your plugins. A WordPress update therefore does not solve this. The solution is an updated PHP version on the server your website runs on.

We follow the developments and take care of what is within our control. This is our approach:

• We keep an eye on your website. Where we can, we monitor our clients’ WordPress websites.
• Do we provide your hosting? Then we take care of the PHP security update.
• Is your website hosted by an external hosting provider? Then that provider usually takes care of the update. Where needed, we coordinate this with them.
• We check your website after the update. We go through the websites involved and check that everything keeps working properly, such as your most important pages, forms and other essential features.

An available update is not the same as an updated website. Updating and checking happens per website and per hosting provider. We do this carefully, step by step.

Our agentic websites do not run on WordPress or PHP. These specific PHP vulnerabilities therefore do not affect those websites. That does not mean security needs no attention there, but this update does not apply to them.

Do you notice something odd about your website, or does a page or form not work the way you are used to? Then get in touch with us. And if you would like to know how this is arranged for your website, we are happy to take a look with you.

For this article we used the official information from (status as of 21 October 2026):

• PHP, news archive 2026
• CERT-EU, Security Advisory 2026-018: Critical Vulnerabilities in PHP