The PHP security team has given advance notice that it will ship a release fixing two critical vulnerabilities on Wednesday, October 21, 2026, at 14:00 UTC (10:00 a.m. Eastern). Both flaws are rated 9.2 on the CVSS v4.0 scale. Beyond that, almost nothing is public yet: not the affected versions, not the fixed version numbers, not CVE identifiers, and not how either bug works.
PHP is the language WordPress is built on, so every WordPress site sits on top of it, which is why Wordfence's Alex Thomas flagged the notice in the original report. The PHP team has also said it may ship earlier than scheduled if details of either vulnerability leak or if it sees evidence of active exploitation, so the 14:00 UTC slot is a latest-expected time, not a guarantee.
Your CMS updates will not cover this one
PHP is server software, not part of WordPress or any other application built on it. Updating WordPress core, plugins or themes does not change the PHP version a server runs. Who applies the fix depends on hosting: on most managed and shared hosting the provider updates PHP, while on a VPS, dedicated server or anything you administer yourself, the job is yours or your developer's.
Packaging adds another wrinkle. If PHP comes from an operating system's packages, a control panel or container images, Wordfence notes those builds may arrive on a different schedule from the official php.net release.
Wordfence says it cannot yet judge how easily the bugs could be used against a WordPress site, because nobody outside the PHP team knows how they are triggered. It plans to review both once details are out, including whether firewall rules can help, while stressing that some flaws in PHP itself can only be fixed by updating PHP.
Find your PHP owner before 14:00 UTC
There is nothing to install yet. What you can do now:
- Check your PHP version. In WordPress it is under Tools, Site Health, Info, Server.
- Confirm who updates PHP on each server. Ask your host whether and when it will apply the release.
- If you run your own servers, book a maintenance window shortly after 14:00 UTC, and watch php.net in case the release lands early.
- Take a fresh backup of files and databases, confirm it restores, and test on staging first if you can.
According to the PHP project's supported versions list, as summarized by Wordfence, PHP 8.5 and 8.4 are in active support, PHP 8.3 receives security fixes until December 31, 2027, and PHP 8.2 receives them until December 31, 2026. Anything at 8.1 or older gets no security fixes from the project. The PHP team has not said whether these two flaws reach older branches, but unsupported versions should not be expected to get a patch.
Pre-announced releases like this one are a courtesy to defenders, a few hours of warning to line up the right people. That head start is only worth something if you already know whose job the update is. Readers who run WordPress have had a busy month, from a Duplicator plugin flaw to stolen UpdraftCentral keys, and this time the fix sits one layer below all of it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.