Hexa Tiger 
Scale My Publication 
SEO for Public Figures 
The PHP security team released an emergency PHP security update on October 21, 2026, for two critical flaws that can let attackers run code on website servers without logging in. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to Search Engine Journal’s report on the flaws.
PHP says installing the PHP security update is the only safe choice because no workaround fully addresses the vulnerabilities. It says all installations serving website requests are at risk.
Who Faces The Highest Risk From The PHP Security Update
Apache servers using mod_php, which runs PHP directly inside Apache, face the highest risk, according to PHP. A demonstrated attack can run before the website’s own code starts.
PHP runs WordPress on the web server, so updating WordPress or its plugins will not update PHP. Site owners need their host to install the fix. When a hosting account lets users switch PHP versions through cPanel, they should confirm that the selected version includes the patch.
Older PHP Versions Need An Upgrade
PHP 8.1 and older remain on the end-of-life list and no longer receive regular official updates. For this emergency, PHP provided limited source-code fixes for PHP 7.4, 8.0 and 8.1 for teams that build PHP themselves.
Hosting providers and long-term support vendors may also supply their own updates. These fixes do not restore ongoing support, so owners of older sites should ask their host to confirm protection while arranging an upgrade.
Government Sites Went Offline First
International Cyber Digest reported that Dutch parliament and cyber agency websites, Finnish government web services and university sites went offline ahead of the release. It described the Finnish shutdowns as a precaution, not a breach.
Sansec also reported that the Dutch House of Representatives and National Cyber Security Centre took their websites offline as a precaution. Ahead of the release, CERT-EU and the UK National Cyber Security Centre advised considering temporary isolation or shutdowns where immediate protection was not possible.
How To Apply The PHP Security Update
Site owners can check their version in WordPress under Tools, then Site Health, then Info, by expanding Server. They should ask their host to apply the PHP security update with one of the fixed versions or confirm that its PHP update includes both fixes.
Sites on PHP 8.1 or older should be backed up before an upgrade. If a site cannot be patched immediately, the report suggests discussing taking it offline until it can be updated.
A web application firewall such as Cloudflare may block some attack attempts, but it is not a substitute for installing the fixes. All visits must pass through the firewall, because attackers who reach the server directly can bypass its checks.
Sites taken offline to patch should show a maintenance page with an HTTP 503 response, as Google recommends. The host can serve that page through the web server or a content delivery network without relying on PHP.
Check For Compromise After Patching
After patching, owners should check for web shells, unfamiliar admin accounts and unexpected PHP file changes. A patch does not remove an existing compromise.
The report’s author wrote that reports of an attack tool circulating before the patch show attackers can move faster than software makers can deliver a fix. The author expects severe vulnerabilities to be uncovered more often, with less time for website owners to respond.
Related coverage: an earlier WordPress vulnerability that needed urgent patching, AI tools that help WordPress find flaws and a Cloudflare Containers security fix.
