Key points
- The update addresses two flaws, both rated 9.2 on the CVSS v4.0 scale.
- The release is scheduled for October 21, 2026, at 14:00 UTC.
- All WordPress sites are affected because they run on the PHP language.
The PHP security team has announced an upcoming critical release that fixes two vulnerabilities. According to Wordfence, both flaws are rated 9.2 on the CVSS v4.0 scale, indicating a high severity level. The update is scheduled for Wednesday, October 21, 2026, at 14:00 UTC. This timing allows administrators to prepare their systems for immediate patching once the files are available.
In plain English
PHP is the programming language that powers many websites, including every WordPress site. When the language itself has a security hole, every site using it is potentially exposed. The two flaws addressed in this release are considered critical by the PHP team. This means they are significant security issues that require attention. The high CVSS score reflects the serious nature of these issues as rated by the security team.
The background
Alan Coopersmith posted advance notice of this release on the oss-security mailing list on October 20. The announcement appeared on the official PHP archive page and was widely shared by security researchers. Wordfence highlighted the impact on WordPress users, noting that the platform relies entirely on PHP. Hacker News also featured the announcement, drawing significant attention from the developer community.
What changes now
Administrators must plan to apply the patch as soon as it is released. The update will be available at 10:00 AM Eastern time. The source material does not specify which PHP versions are affected, so all users should monitor for details. Organizations should monitor the official PHP announcement channel for the final download links and detailed technical descriptions of the fixed vulnerabilities.
Who needs to act first
Teams usually prioritize public-facing web servers because they are directly exposed to the internet. Check whether your hosting provider manages PHP updates or if you handle them manually. It is wise to back up your websites and databases before applying any changes. Test the update on a staging environment first to ensure your applications still work correctly. Roll out the fix to production systems in small batches to catch any unexpected issues early.
Background: PHP application vulnerabilities
PHP vulnerabilities occur when web applications process user input incorrectly. Attackers exploit these gaps to view private files, execute commands, or steal credentials. You reduce risk by validating all input, keeping software updated, and restricting file permissions. Proper configuration prevents most common attacks.
Read the full guide: PHP Application Vulnerabilities: Simple Causes and Fixes
What to do and how to stay safe: PHP
- Verify which PHP version your servers are running by checking your hosting control panel or server configuration files.
- Subscribe to the PHP security mailing list or RSS feed to receive instant notification when the patch is released.
- Review your server logs for any unusual activity that might indicate exploitation of known vulnerabilities before the patch arrives.
- Ensure your backup systems are functioning correctly so you can restore your site if the update causes compatibility issues.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When will the PHP security patch be available?
The release is scheduled for Wednesday, October 21, 2026, at 14:00 UTC.
How severe are the vulnerabilities being fixed?
Both vulnerabilities are rated 9.2 on the CVSS v4.0 scale, which is considered critical.
Does this affect WordPress sites?
Yes, every WordPress site runs on PHP, so all WordPress installations are affected by these language-level flaws.
