Website owner alert: PHP released security updates on 21 October 2026 after two critical vulnerabilities were disclosed. If your business website runs PHP, ask your hosting provider to confirm that the server is running a fixed release and that your WordPress site remains healthy after the update.

This guide is for small-business owners who use WordPress or another PHP-powered website and want a clear, safe checklist—not a risky server configuration change.

What happened?

The PHP project announced security releases including PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 to address two critical vulnerabilities that could potentially allow remote code execution in affected configurations. The official PHP release archive and advisory should be treated as the source of truth for affected versions and fixes.

Read the official PHP 2026 release archive for current release information. PHP is the server-side runtime and is commonly managed by the hosting provider.

Does this affect my WordPress website?

If your website is hosted on a server running an affected PHP build, it may be exposed even if the WordPress dashboard looks normal. Your exact risk depends on the PHP version, server handler, configuration and whether the host has applied the fixed release. Site owners should verify rather than guess.

WordPress themes and plugins can introduce separate compatibility problems when PHP changes. Follow a security update with a quick site health check.

What to do first

1. Contact your host. Ask which PHP version and patch level currently serve your website, whether the fixed release is applied, and whether any action is needed from you.
2. Back up the site. Confirm that a recent database and file backup exists before any planned runtime change.
3. Update WordPress components. Install supported updates for WordPress core, your active theme and plugins from legitimate update channels.
4. Test important journeys. Check the homepage, contact form, booking or quote form, checkout if applicable, and WordPress admin after the host confirms the update.
5. Review error logs. If the site starts showing a critical error, record the exact timestamp and ask your host or developer to inspect the relevant PHP error log.

What not to do

• Do not switch PHP versions randomly on a live business website.
• Do not install unofficial “security fix” files or plugins from unknown sources.
• Do not expose PHP error details to visitors. Debugging should be logged privately.
• Do not assume hiding warnings is a substitute for applying the security update.

What if the site breaks after the update?

A broken page after a PHP update may be caused by an outdated plugin, theme, custom code or a resource limit. Save the exact error message, check the private error log and test changes on staging where possible. Avoid disabling every plugin on a live site without a recovery plan.

For background, see our guide to what to do if your website is hacked if you have signs of compromise.

Small-business website security checklist

• Know who manages your hosting and PHP runtime.
• Keep a recent, restorable backup.
• Remove unused themes and plugins.
• Use unique administrator passwords and multi-factor authentication where available.
• Keep WordPress, themes and plugins updated.
• Check forms and key pages after maintenance.

Need help checking your website?

If you are unsure who manages PHP updates or whether your site is still working correctly, request a free five-point website review. Send your website URL, business type and the main issue you have noticed.

Request a free website review or explore our monthly website plans.

Last reviewed: 23 October 2026. Verify affected versions and remediation guidance against the official PHP advisory before acting.