SECURITY ALERT
Two critical PHP flaws were patched on 21 October 2026. Here is what to do.
AllInfo AI
WHAT HAPPENED
Two bugs in PHP itself can let attackers run code on a web server without logging in.
WHO IS AFFECTED
WordPress, Drupal and Joomla all run on PHP. Old, unpatched servers face the most risk.
STEP 1
In WordPress, open Tools, then Site Health, then the Info tab and the Server section.
STEP 2
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fix. PHP 8.1 and older get no update.
STEP 3
Many hosts patched shared plans for you. VPS owners must update PHP themselves.
STEP 4
Check for unknown admins, new plugins and spam pages. Change passwords if anything looks odd.
STAY SAFE
Our full guide covers firewalls, backups and what the quick workarounds really do.