← All articles Blog

Two Critical PHP Flaws Rated 9.2 Patched 21 October: What to Do Now

Hamza Tech · October 21, 2026 · 5 min read

If your website runs on WordPress, there is a security update you need to know about today. The PHP security team has identified two critical vulnerabilities, both scoring 9.2 out of 10, with security patches scheduled for release on October 21, 2026. PHP is the programming language that powers WordPress and millions of other websites, so this WordPress security update affects a huge part of the internet. Here is what has been announced, which sites are most at risk, and the practical steps every site owner should take now.

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.

PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
— The PHP Foundation (@ThePHPF) October 20, 2026

What the PHP Security Team Announced

On 20 October, the PHP security team gave rare advance notice of an urgent release. The patches will be released on Wednesday, 21 October, at 14:00 UTC, corresponding to 1 am AEDT on Thursday, 22 October, in Sydney and 10 pm AWST on Wednesday in Perth. Both flaws are rated critical under version 4 of the industry’s severity scoring system, as Help Net Security reported.

The team has not yet described the flaws or said exactly which versions are affected. Those details, along with the fixed version numbers, will be published with the release. Administrators should treat all PHP installations under their management as potentially vulnerable until the patches are released. The team also said it may release earlier if details become public or if attackers start exploiting the bugs.

Why the warning came early

The timing was not planned. Information about the embargoed bugs leaked on 20 October through a post on the Hacker News forum. Security firm watchTowr then confirmed they are remote code execution vulnerabilities, the most serious kind, because they can let an attacker run their own code on a server. Researchers have nicknamed the pair “php2shell”, and security firms track them as CVE-2026-109618 and CVE-2026-109619, according to Sansec’s analysis. PHP moved its release forward by a day in response.

How Serious Is This?

A score of 9.2 sits in the critical band, which runs from 9.0 to 10.0. Advance notice for two issues at once is unusual and signals how seriously the PHP team is treating them. There is some reassuring news, though. As of 21 October, watchTowr reported no known exploitation, and the flaws had not been added to the US government’s list of actively exploited vulnerabilities.

Older PHP versions are the biggest worry

The bigger long-term risk is outdated software. PHP 8.1, 8.0 and all 7.x versions are already past end of life, so if the flaws reach back that far, there will be no official fix for them at all. That matters, because security firm Mallory counted roughly 884,000 internet-facing servers reporting PHP 8.1 or older, about 59% of servers that showed a version number, according to The Hacker News.

What WordPress Site Owners Should Do Now

You can secure your website without having any development experience. Follow these steps:

Check your PHP version. In your WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. Your PHP version is listed there.
Contact your hosting provider. Most managed WordPress hosts update PHP for you. Ask them to confirm they will apply the patched version as soon as it is released on 21 October.
If you’re using an older version, plan to upgrade as soon as possible. If your site runs PHP 8.1 or older, ask your host to move it to a supported version such as PHP 8.3 or 8.4. PHP 8.2 has only a couple of months of security support left, so it is not a good long-term choice.
Back up your site first. A fresh backup of your files and database protects you if an update causes problems.
Update WordPress, themes and plugins too. Keeping everything current reduces the number of ways in for attackers.
Watch for unusual activity. Unexpected admin accounts, strange files or sudden slowdowns can be signs of a compromise.

Some researchers have suggested switching off a PHP setting called session.upload_progress as a temporary measure, but reports say it may only block one of the two bugs. Only make server changes like this with your host’s help, and treat the official update as the real fix.

Security threats can come from unexpected places, as our report on spyware hidden in online ads shows. Our how to secure your WordPress site guide covers more protection steps.

Act Now, Not After an Attack

With two critical vulnerabilities affecting software that powers much of the web, this ranks among the year’s most significant website security updates. The good news is that the fix is coming fast, and most site owners can be protected with a single conversation with their host. Check your PHP version today, confirm your host’s update plan, and make sure your site is running a supported release.

Frequently Asked Questions

Is my WordPress site definitely vulnerable?

Not necessarily. The affected versions will be confirmed with the release. Until then, the safest assumption is that any PHP site could be affected.

Do I need to update WordPress itself?

The fix is in PHP, which runs underneath WordPress. Your hosting provider usually handles PHP updates, but it’s still essential to keep WordPress up to date.