Got the Urgent PHP Vulnerability Email? What It Means for Your WordPress Site

If your website runs WordPress, the email applies to you. WordPress is written in PHP, and PHP is what has the hole. Clicking “Update” in your WordPress dashboard won’t fix it, because PHP sits underneath WordPress on the server. The job this week is finding out who updates PHP on your server, and making sure they have.

I got the same email from DigitalOcean on October 21, and a few more like it from other services before lunch. They read like a fire alarm because, for a lot of servers, it is one. But most people getting them don’t run a server. They have a website someone set up for them, and they need to know which of three or four situations they’re in.

What actually happened

On October 21, 2026, the PHP project released fixes for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Both can let someone on the internet run their own code on a server running PHP, without logging in to anything. The PHP project says every PHP installation serving web pages is at risk, back through very old versions.

The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The details leaked a day before the planned release, so the fix went out early. By the afternoon of the 21st, Cloudflare and the security firm watchTowr were both reporting attempts to exploit it. Nobody had confirmed a successful break-in when I wrote this. That window tends to close quickly, and the PHP project’s own advice is that updating is the only complete fix.

That’s all you need from the technical side. The rest is about your site.

Why your WordPress dashboard can’t tell you

WordPress shows you updates for three things: WordPress itself, your plugins, and your theme. It has no button for PHP, because WordPress doesn’t install or update PHP. Your server does.

WordPress does keep an eye on one thing. If your PHP version is old enough to be out of support, it puts a box at the top of your dashboard titled PHP Update Required or PHP Update Recommended, saying “Your site is running on an outdated version of PHP,” with the version number and a link to a page about updating. If you’ve seen that box and closed it because you didn’t know what to do with it, you’re in good company. It’s telling you to ask whoever runs your server to upgrade, which this week has become urgent.

What WordPress can’t see is whether your version has this week’s fix. A site on PHP 8.3.20 gets no warning at all, because 8.3 is supported. It’s still missing the October 21 patch.

So a dashboard showing everything green tells you nothing about this. I’ve seen sites with every plugin current running on a version of PHP that stopped getting security fixes years ago. Nobody was being careless. The person clicking Update in WordPress and the person responsible for the server were different people, or the second one didn’t exist.

Check which version you’re running

This takes two minutes and tells you most of what you need.

If you can’t log in, or you don’t know who can, that’s an answer too. It goes in the last situation below.

Which situation you’re in

Managed WordPress hosting (WP Engine, Kinsta, Flywheel, Pressable and the like). Your host updates PHP. Many of them will have done it before you read their email. Check your version anyway, and if it isn’t patched, open a support ticket. This is what the higher monthly price buys you, and it’s a fair thing to ask for this week.

Shared hosting with a control panel (GoDaddy, Bluehost, SiteGround, anything with cPanel). Usually the host patches PHP itself and you pick which branch your site uses, like 8.3 or 8.4. The thing to watch for is a site that was pinned to an old branch years ago so a plugin would keep working. The host may patch the current branches and leave yours alone.

Your own server. A DigitalOcean Droplet, a Marketplace “1-Click” WordPress image, an AWS or Linode server someone set up for you. Nobody patches this unless someone does it on purpose. That’s why DigitalOcean emailed everyone and is pulling affected Marketplace images until they’re fixed. If a past developer set this up and moved on, assume it hasn’t been touched.

You don’t know. More common than anyone admits. You pay a monthly bill, the site works, and the person who built it isn’t around anymore. Start with whoever bills you for hosting. If you can’t find out who controls the server, that’s the bigger problem, and this walkthrough on owning your own accounts covers how to fix it.

If you’re on PHP 8.1 or older

This is the part that will catch the most small business sites, and it isn’t a quick fix.

PHP 8.1 and everything before it no longer get official updates. The PHP project made rough patches available for 7.4 through 8.1 because these flaws are so serious, but they’re source code for people who build PHP themselves. Your host has to decide to use them, and some won’t.

The real fix is moving to a supported version. On an older WordPress site, that’s where things go wrong. Old plugins and themes are often the reason a site got left on an old PHP version in the first place, because the upgrade broke something and rolling back was the easy answer. Upgrading PHP now can break the same thing. Test the upgrade on a copy of the site, or have whoever maintains it do that, before you change the live one.

And PHP 8.2, one of the four patched branches, stops getting security fixes on December 31, 2026. If you land on 8.2 this week, you’ll be making the same decision again in ten weeks.

What the version number says about your host

The number you just looked up answers a bigger question than this week’s email: is anyone maintaining your server at all?

I see this all the time, mostly with low-cost hosting. A site goes up on a server running whatever operating system (usually a version of Ubuntu) and whatever PHP were current that year. Then nothing underneath it changes again. The bill arrives every month and the site keeps loading, so nobody asks. Years later the server is running software that stopped getting security fixes long ago, and the first anyone hears of it is an email like this one, or a hacked site.

Two numbers on that same Site Health screen tell you most of the story:

• PHP version. PHP 7.4 stopped getting security fixes in November 2022, 8.0 in November 2023 and 8.1 at the end of 2025. If you see any of those, PHP has been left alone since it went out of support.
• Database version, under the Database section. If it says MySQL 5.7 or 8.0, that’s past end of life too. 5.7 ended in October 2023 and 8.0 in April 2026.

One fairness note on shared hosting: an old PHP version is sometimes a setting on your account, chosen years ago to keep an old plugin working, while the host offers newer versions you never switched to. That’s less the host’s fault. It still means nobody has been watching.

The operating system you usually can’t see from WordPress. Ask your host: “What operating system version is my server running, and when was it last upgraded?” A host that maintains anything can answer in a sentence.

The part that isn’t about this week

This one will get patched. Most hosts will have it done within days, and most sites will be fine.

What I’d take from the email is how many layers are underneath a WordPress site. The site you see is WordPress, plus a theme, plus plugins. Under that is PHP. Under that is a web server, a database and an operating system. Each layer has its own maintainers and its own security releases, on its own schedule. This week it was PHP. The last few years have had plenty for the other layers too, and there will be more.

WordPress gets the blame for being hacked, but most of what has to be patched is the stack it needs to run.

If you’re on good managed hosting, someone is absorbing all of that for you. That’s a legitimate way to run a site, and for a store, a membership site or a busy newsroom, it’s usually the right one.

My own sites are static: plain HTML files on a content delivery network. There’s no PHP on them, no database, and no server of mine answering requests. When the DigitalOcean email arrived, I had nothing to patch. I still have things to look after. The tools that build the site get security updates, and my domain and hosting logins need protecting like anyone’s. But those tools run on my laptop when I publish, not on a public server waiting for strangers.

For a business site that changes a few times a year, that’s the trade I’d make. I wrote up the full comparison, including where WordPress is the better choice.

Frequently Asked Questions

Does updating WordPress fix the PHP vulnerability?

No. WordPress, plugins and themes run on top of PHP, and updating them doesn't change the PHP version on your server. PHP is updated by your host or by whoever manages the server. Check your version under Tools, then Site Health, then Info, then Server.

Has my WordPress site been hacked?

Not necessarily. Having an unpatched PHP version means your site was exposed, not that it was broken into. Patch first. If you see unfamiliar admin accounts, strange redirects or files you didn't add, treat it as compromised and follow the recovery steps for a hacked WordPress site.

WordPress says PHP Update Required. What should I do?

That box means your server runs a PHP version that no longer gets security fixes. You can't fix it from inside WordPress. Ask your host or whoever manages the server to move the site to a supported version, ideally 8.3 or newer since 8.2 loses support at the end of 2026, and to test it on a copy first, because old plugins and themes sometimes break on a newer PHP.

Which PHP versions are patched?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026. Anything newer within those branches is also fine. PHP 8.1 and older get no official release, and PHP 8.2 stops receiving security fixes after December 31, 2026.

My host emailed me about this. Do I need to do anything?

Check your PHP version either way. On managed WordPress hosting, your host is usually already patching. On shared hosting, make sure your site isn't pinned to an old PHP branch. On your own server, such as a DigitalOcean Droplet or a 1-Click image, you or your developer have to apply the update.

How do I know if my web host is keeping my server up to date?

Check your PHP and database versions in WordPress under Tools, then Site Health, then Info. PHP 8.1 or older, or MySQL 5.7 or 8.0, means that software is past end of life and nobody has upgraded it. Then ask your host which operating system version the server runs and when it was last upgraded. A host that maintains your server can answer quickly.

Do static websites need to worry about PHP vulnerabilities?

No. A static site is a set of finished HTML files served from a content delivery network, with no PHP running when someone visits. The tools that build the site still get security updates, and the domain and hosting accounts still need protecting, but there is no PHP on a public server to attack.