Critical PHP Security Update: Check Your Website Today

On October 21, PHP released an emergency security update. It fixes two critical flaws that let an attacker run code on a server over the internet. PHP rates both 9.2 out of 10.

WordPress runs on PHP, so this affects nearly every WordPress site. Codeable reports that WordPress.org confirms no WordPress update is needed. Updating WordPress and its plugins will not fix this, because the flaws sit in PHP itself.

The fixed versions

8.5.12 fixes the PHP 8.5 branch
8.4.27 fixes the PHP 8.4 branch
8.3.36 fixes the PHP 8.3 branch
8.2.35 fixes the PHP 8.2 branch

PHP 8.1 and older get no official fix. Some providers, including cPanel, have backported the fix to PHP 7.4, 8.0, and 8.1. Even so, plan to move to PHP 8.2 or later.

How to check your site

In WordPress, open Tools, then Site Health, then Info, then Server.
Find your PHP version, and compare it with the fixed versions above.
If you use managed WordPress hosting, ask whether your host has applied the update, because managed hosts typically patch PHP for you.
If your host has not patched yet, ask when it will, and what protection is in place until then.
Take a backup before any update, so you can roll back.

PHP has published temporary mitigations, but it calls them incomplete. Updating to a fixed version is the only complete fix.

This is another reminder that updates matter beyond plugins, as covered in WordPress plugin security. For the broader routine, see what happens to a website nobody maintains.

FAQ

Do I need to update WordPress?

No. The flaws are in PHP, so a WordPress update will not fix them. Your host or server administrator needs to update PHP.

What if my host has not patched yet?

Ask for a timeline and for any interim protection. PHP publishes temporary mitigations, but they are incomplete, so treat them as a stopgap.

Getting started

We manage WordPress sites, including PHP updates, backups, and monitoring. Book a Free Call, and we will check your PHP version and your host’s patch status.