{"id":1481,"date":"2026-10-21T11:36:07","date_gmt":"2026-10-21T11:36:07","guid":{"rendered":"https:\/\/www.ahosting.net\/blog\/?p=1481"},"modified":"2026-10-21T13:16:15","modified_gmt":"2026-10-21T13:16:15","slug":"php-critical-security-release-october-2026-wordpress","status":"publish","type":"post","link":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/","title":{"rendered":"PHP Critical Security Release: What WordPress Site Owners Should Do Now"},"content":{"rendered":"\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Does the PHP critical security release put my WordPress site at risk in 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, any WordPress site runs on PHP, so a critical PHP flaw can reach it whatever plugins it uses. However, PHP has not published the affected versions yet. Therefore, treat every site as exposed until the advisory names fixed versions.\"}}, {\"@type\": \"Question\", \"name\": \"When is the PHP critical security release and could it arrive earlier than planned?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, PHP scheduled the release for Wednesday 21 October 2026 at 14:00 UTC. However, the security team reserved the right to ship earlier if details become public or exploitation appears. As a result, prepare before the stated time, not at it.\"}}, {\"@type\": \"Question\", \"name\": \"Does a green PHP check in WordPress Site Health prove the PHP critical security release reached my site?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In fact, it does not. The check compares your PHP version with a recommended version from WordPress.org and shows green at or above it. Therefore, a site on an unpatched point release of a current branch still shows green. Read the full version string instead.\"}}, {\"@type\": \"Question\", \"name\": \"PHP 8.4 vs PHP 8.5: which branch should a WordPress site be on for security support in 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, php.net lists security support for 8.4 until 31 December 2028 and for 8.5 until 31 December 2029. Both receive fixes today. However, WordPress plugin compatibility is the practical limit, so test on staging before moving a live site.\"}}, {\"@type\": \"Question\", \"name\": \"Who applies the PHP critical security release on shared hosting vs a VPS?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Typically, a shared host installs the patched PHP packages and you choose the branch your site uses. On a VPS, by contrast, you or your administrator must update the packages yourself. In practice, ask your provider which of the two applies to your plan.\"}}, {\"@type\": \"Question\", \"name\": \"My WordPress site runs PHP 8.2 in 2026, so should I wait for the PHP critical security release patch or upgrade now?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Notably, php.net lists 8.2 with security support only until 31 December 2026. A fix for 8.2 is not confirmed for this release. Therefore, back up, test on staging, and plan the move to 8.3 or later instead of waiting.\"}}, {\"@type\": \"Question\", \"name\": \"What should I do if my WordPress site runs PHP 8.0 or an older end-of-life branch?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"First and foremost, move to a supported branch, because php.net no longer lists the older ones. WordPress Site Health already flags such versions as critical because they receive no security updates. Consequently, a patch is unlikely to reach them.\"}}, {\"@type\": \"Question\", \"name\": \"How do I check which PHP version my AHosting WordPress site uses in cPanel?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, open MultiPHP Manager in cPanel and read the PHP version listed beside each domain. Alternatively, open Tools, Site Health, Info, Server inside WordPress. In other words, the two views should agree, and a mismatch points to a per-domain override.\"}}, {\"@type\": \"Question\", \"name\": \"Does AHosting CageFS limit the damage if a PHP flaw is exploited on one site?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, AHosting customer servers run CloudLinux with CageFS and LVE, and each PHP process runs as the cPanel user that owns the site. As a result, an exploited site is confined to what that account can reach. However, nobody has published the flaws yet, so this is design intent, not a guarantee.\"}}, {\"@type\": \"Question\", \"name\": \"How can AHosting help me confirm my PHP version after the PHP critical security release?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In practice, open a ticket with the PHP version shown under Tools, Site Health, Info, Server and we will look at it with you. Additionally, mention your domain so we can compare it with the version cPanel lists for that site.\"}}]}<\/script>\n\n\n<div class=\"wp-block-aioseo-table-of-contents\"><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-php-critical-security-release-what-was-announced-and-what-is-still-unknown\">PHP Critical Security Release: What Was Announced and What Is Still Unknown<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-php-critical-security-release-facts-you-can-rely-on\">PHP Critical Security Release Facts You Can Rely On<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-why-php-critical-security-release-timing-is-a-plan-not-a-promise\">Why PHP Critical Security Release Timing Is a Plan, Not a Promise<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-does-the-php-critical-security-release-affect-your-wordpress-site\">Does the PHP Critical Security Release Affect Your WordPress Site?<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-the-announcement-says-about-wordpress\">What the Announcement Says About WordPress<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-why-a-wordpress-update-will-not-fix-a-php-flaw\">Why a WordPress Update Will Not Fix a PHP Flaw<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-why-a-green-site-health-check-does-not-mean-the-php-critical-security-release-reached-you\">Why a Green Site Health Check Does Not Mean the PHP Critical Security Release Reached You<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-the-php-version-test-actually-compares\">What the PHP Version Test Actually Compares<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-site-health-is-still-good-for\">What Site Health Is Still Good For<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-how-to-find-your-php-version-before-the-php-critical-security-release\">How to Find Your PHP Version Before the PHP Critical Security Release<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-read-the-php-version-inside-wordpress\">Read the PHP Version Inside WordPress<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-read-the-php-version-in-cpanel-multiphp-manager\">Read the PHP Version in cPanel MultiPHP Manager<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-read-the-php-version-on-a-vps\">Read the PHP Version on a VPS<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-php-critical-security-release-readiness-check-your-next-steps\">PHP Critical Security Release Readiness: Check Your Next Steps<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-before-the-php-critical-security-release-four-steps\">Before the PHP Critical Security Release: Four Steps<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-after-the-php-critical-security-release-four-steps\">After the PHP Critical Security Release: Four Steps<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-which-php-branches-still-receive-security-fixes-after-the-release\">Which PHP Branches Still Receive Security Fixes After the Release<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-to-do-if-the-php-critical-security-release-skips-your-end-of-life-php-version\">What to Do if the PHP Critical Security Release Skips Your End-of-Life PHP Version<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-end-of-life-php-is-still-selectable-on-many-hosts\">End-of-Life PHP Is Still Selectable on Many Hosts<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-a-safe-move-off-an-old-php-branch\">A Safe Move Off an Old PHP Branch<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-who-applies-the-php-critical-security-release-shared-hosting-vps-or-you\">Who Applies the PHP Critical Security Release: Shared Hosting, VPS or You?<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-shared-hosting-the-host-patches-you-verify\">Shared Hosting: The Host Patches, You Verify<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-vps-and-dedicated-servers-you-patch\">VPS and Dedicated Servers: You Patch<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-agencies-many-sites-one-version-check\">Agencies: Many Sites, One Version Check<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-php-critical-security-release-october-2026-wordpress\">Frequently Asked Questions: PHP Critical Security Release<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#faq-php-vulnerability-2026-wordpress\">Does the PHP critical security release put my WordPress site at risk in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-php-critical-security-release-date\">When is the PHP critical security release and could it arrive earlier than planned?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-php-version-wordpress-site-health\">Does a green PHP check in WordPress Site Health prove the PHP critical security release reached my site?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-php-8-4-vs-php-8-5-security\">PHP 8.4 vs PHP 8.5: which branch should a WordPress site be on for security support in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-php-critical-security-release-shared-vs-vps\">Who applies the PHP critical security release on shared hosting vs a VPS?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-php-critical-security-release-php-82-2026\">My WordPress site runs PHP 8.2 in 2026, so should I wait for the PHP critical security release patch or upgrade now?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-php-critical-security-release-end-of-life-branch\">What should I do if my WordPress site runs PHP 8.0 or an older end-of-life branch?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-ahosting-php-version-cpanel\">How do I check which PHP version my AHosting WordPress site uses in cPanel?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-ahosting-php-isolation-cagefs\">Does AHosting CageFS limit the damage if a PHP flaw is exploited on one site?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-ahosting-php-ticket-help\">How can AHosting help me confirm my PHP version after the PHP critical security release?<\/a><\/li><\/ul><\/li><\/ul><\/div>\n\n\n<div class=\"ah-tldr\">\n  <span class=\"ah-tldr-badge\">TL;DR<\/span>\n  <p>The PHP critical security release is due on 21 October 2026 at 14:00 UTC and fixes two flaws rated CVSS 9.2. PHP has not named the affected versions yet, so treat every WordPress site as exposed until it does. Check your full PHP version now, back up, and update as soon as the fixed version for your branch is published. A green Site Health PHP check does not prove you are patched.<\/p>\n<\/div>\n\n\n\n<figure class=\"wp-block-audio\"><audio preload=\"none\" controls src=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/PODCAST-php-critical-security-release-october-2026-wordpress.m4a\"><\/audio><figcaption class=\"wp-element-caption\">Listen: what PHP has confirmed about the release, how to read your full PHP version, and the steps to take before and after it lands. By Matt Chrust, Director of Business Development, AHosting.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The PHP critical security release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC, and every WordPress site runs on the software it patches. Specifically, the PHP security team <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-20-1\" target=\"_blank\" rel=\"noopener\">announced<\/a> two vulnerabilities, both rated CVSS v4.0 9.2, and asked all users to prepare now. However, the notice does not yet say which PHP versions are affected or which versions fix them. Therefore, this guide sticks to what is confirmed, shows how to check your site in two minutes, and explains why WordPress itself cannot tell you whether you are patched.<\/p>\n\n\n\n<h2 id=\"aioseo-php-critical-security-release-what-was-announced-and-what-is-still-unknown\" class=\"wp-block-heading\">PHP Critical Security Release: What Was Announced and What Is Still Unknown<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In its news entry of 20 October 2026, PHP confirmed the date, the count and the severity. Notably, the same text went to the developer list, where the PHP security team <a href=\"https:\/\/discourse.thephp.foundation\/t\/php-dev-upcoming-critical-php-security-release\/6249\" target=\"_blank\" rel=\"noopener\">posted it for php.internals<\/a>. Consequently, there is one primary source for every confirmed fact below.<\/p>\n\n\n\n<h3 id=\"aioseo-php-critical-security-release-facts-you-can-rely-on\" class=\"wp-block-heading\">PHP Critical Security Release Facts You Can Rely On<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The table separates what PHP confirmed from what press coverage claims. In particular, two CVE identifiers are circulating, but <a href=\"https:\/\/blog.qualys.com\/vulnerabilities-threat-research\/2026\/10\/20\/php-announces-critical-security-release-for-two-vulnerabilities\" target=\"_blank\" rel=\"noopener\">Qualys reports<\/a> that PHP has not confirmed them.<\/p>\n\n\n\n<figure class=\"wp-block-table ah-ladder\"><table><thead><tr><th>Item<\/th><th>Status as of 21 October 2026<\/th><th>Source<\/th><\/tr><\/thead><tbody><tr><td>Release date and time<\/td><td>Confirmed: Wednesday 21 October 2026, 14:00 UTC<\/td><td>php.net news entry<\/td><\/tr><tr><td>Number of vulnerabilities<\/td><td>Confirmed: two<\/td><td>php.net news entry<\/td><\/tr><tr><td>Severity<\/td><td>Confirmed: CVSS v4.0 9.2 for each (critical)<\/td><td>php.net news entry<\/td><\/tr><tr><td>Earlier release<\/td><td>Possible if details become public or exploitation appears<\/td><td>php.net news entry<\/td><\/tr><tr><td>CVE identifiers<\/td><td>Unconfirmed: public reports link CVE-2026-109618 and CVE-2026-109619<\/td><td>Qualys blog<\/td><\/tr><tr><td>Affected PHP versions<\/td><td>Not published yet<\/td><td>php.net, Qualys<\/td><\/tr><tr><td>Fixed PHP versions<\/td><td>Not published yet<\/td><td>php.net, Qualys<\/td><\/tr><tr><td>Type of flaw<\/td><td>Not stated in the notice<\/td><td>php.net news entry<\/td><\/tr><tr><td>Exploitation in the wild<\/td><td>None reported in the coverage we read<\/td><td>Help Net Security<\/td><\/tr><tr><td>WordPress-specific impact<\/td><td>Not stated by PHP<\/td><td>php.net news entry<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">AHosting PHP Security Release Fact Ledger: confirmed against unconfirmed, written before the 14:00 UTC release.<\/figcaption><\/figure>\n\n\n\n<h3 id=\"aioseo-why-php-critical-security-release-timing-is-a-plan-not-a-promise\" class=\"wp-block-heading\">Why PHP Critical Security Release Timing Is a Plan, Not a Promise<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">PHP reserved the right to ship earlier. As a result, the 14:00 UTC time is the latest you should expect, not the earliest. Indeed, preparing before the release costs you ten minutes, while preparing after it costs you a rushed afternoon.<\/p>\n\n\n\n<h2 id=\"aioseo-does-the-php-critical-security-release-affect-your-wordpress-site\" class=\"wp-block-heading\">Does the PHP Critical Security Release Affect Your WordPress Site?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress is a PHP application, so every page request runs through the PHP interpreter on your server. Therefore, a flaw in PHP sits underneath your site whatever theme or plugins you use. However, whether a given flaw is reachable from a WordPress page depends on details nobody has published yet.<\/p>\n\n\n\n<h3 id=\"aioseo-what-the-announcement-says-about-wordpress\" class=\"wp-block-heading\">What the Announcement Says About WordPress<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In fact, it says nothing. PHP does not mention WordPress, and the <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/21\/php-security-release-announcement-october-2026\/\" target=\"_blank\" rel=\"noopener\">Help Net Security report<\/a> only tells WordPress owners where to find their PHP version. Likewise, Qualys advises organizations to prepare for expedited patching and to inventory every PHP system. In other words, the safe reading is that every PHP installation could be affected until the advisory says otherwise.<\/p>\n\n\n\n<h3 id=\"aioseo-why-a-wordpress-update-will-not-fix-a-php-flaw\" class=\"wp-block-heading\">Why a WordPress Update Will Not Fix a PHP Flaw<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Typically, a flaw in the PHP engine is fixed in PHP, not in WordPress. As such, updating plugins and themes remains good practice but will not close this gap. For the wider picture of what a host can add at server level, see our guide to <a href=\"https:\/\/www.ahosting.net\/blog\/wordpress-hosting-security-2026-server-level-protection\/\">server-level WordPress hosting security<\/a>.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"ah-yt\" data-id=\"yWJ5K8HUys8\" data-title=\"PHP Critical Security Release: What WordPress Owners Do Now (2026)\"><img src=\"https:\/\/i.ytimg.com\/vi\/yWJ5K8HUys8\/hqdefault.jpg\" alt=\"\" width=\"480\" height=\"360\" loading=\"lazy\" decoding=\"async\"><button type=\"button\" class=\"ah-yt-play\" aria-label=\"Play video: PHP Critical Security Release: What WordPress Owners Do Now (2026)\"><span aria-hidden=\"true\"><\/span><\/button><\/div>\n<\/div><\/figure>\n\n\n\n<h2 id=\"aioseo-why-a-green-site-health-check-does-not-mean-the-php-critical-security-release-reached-you\" class=\"wp-block-heading\">Why a Green Site Health Check Does Not Mean the PHP Critical Security Release Reached You<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress ships a PHP check in Site Health, and it is tempting to treat green as patched. Specifically, we read its source in WordPress 7.1.2: the test is <code>get_test_php_version<\/code> in <code>wp-admin\/includes\/class-wp-site-health.php<\/code>, lines 736 to 860. In short, it measures branch support, not patch level.<\/p>\n\n\n\n<h3 id=\"aioseo-what-the-php-version-test-actually-compares\" class=\"wp-block-heading\">What the PHP Version Test Actually Compares<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">First, the test asks the WordPress.org Serve Happy service for a recommended version and three flags. Next, it compares your <code>PHP_VERSION<\/code> with the recommended version. If yours is equal or higher, the result is good and the label reads that you run a recommended version of PHP. Only below that line does it look at whether the branch is still supported.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consequently, a site on any point release of a current branch shows green, including one that has not received a fix. Nothing in that function checks your exact release against a list of fixed releases. That is a design choice, not a bug, but it matters on the day a critical fix ships.<\/p>\n\n\n\n<h3 id=\"aioseo-what-site-health-is-still-good-for\" class=\"wp-block-heading\">What Site Health Is Still Good For<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">That said, the label prints your full version, for example the text <em>Your site is running PHP<\/em> followed by the exact number. In addition, WordPress marks a branch with no security updates as critical. Therefore, use Site Health to read the version string and the end-of-life warning, and ignore the color for patch status.<\/p>\n\n\n\n<h2 id=\"aioseo-how-to-find-your-php-version-before-the-php-critical-security-release\" class=\"wp-block-heading\">How to Find Your PHP Version Before the PHP Critical Security Release<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You need the full version, such as 8.4.26, not just 8.4. Specifically, there are three places to read it, and the first two take under two minutes.<\/p>\n\n\n\n<h3 id=\"aioseo-read-the-php-version-inside-wordpress\" class=\"wp-block-heading\">Read the PHP Version Inside WordPress<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Log in to the WordPress admin area.<\/li>\n\n\n\n<li>Open Tools, then Site Health, then the Info tab.<\/li>\n\n\n\n<li>Expand the Server section and read the PHP version line.<\/li>\n\n\n\n<li>Write the full number down, including the last segment.<\/li>\n<\/ol>\n\n\n\n<h3 id=\"aioseo-read-the-php-version-in-cpanel-multiphp-manager\" class=\"wp-block-heading\">Read the PHP Version in cPanel MultiPHP Manager<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Alternatively, cPanel lists the version for each domain. According to the <a href=\"https:\/\/docs.cpanel.net\/cpanel\/software\/multiphp-manager-for-cpanel\/\" target=\"_blank\" rel=\"noopener\">cPanel MultiPHP Manager documentation<\/a>, each domain can use any installed PHP version, and an Inherited label means it follows the system version. Notably, only the system administrator can change that system default, and a provider can switch the interface off.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, the two views should agree. If they do not, a per-domain setting or a file in your document root is overriding one of them. For that case, our post on the <a href=\"https:\/\/www.ahosting.net\/blog\/your-server-is-running-php-version-error\/\">PHP version error WordPress shows<\/a> walks through the usual causes.<\/p>\n\n\n\n<h3 id=\"aioseo-read-the-php-version-on-a-vps\" class=\"wp-block-heading\">Read the PHP Version on a VPS<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On a server you manage, run <code>php -v<\/code> over SSH. However, the command line can use a different PHP than the web server, so confirm the web version in Site Health as well.<\/p>\n\n\n\n<h2 id=\"aioseo-php-critical-security-release-readiness-check-your-next-steps\" class=\"wp-block-heading\">PHP Critical Security Release Readiness: Check Your Next Steps<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The checker below turns your branch and server type into next steps. It uses only facts confirmed on php.net, and it will not guess a fixed version.<\/p>\n\n\n\n<style>\n.ahphp-tool{border:1px solid #2563eb;border-radius:12px;padding:20px;background:#eff6ff;margin:24px 0}\n.ahphp-tool h3{margin:0 0 12px;font-size:1.25rem}\n.ahphp-tool label{display:block;font-weight:600;margin:12px 0 4px}\n.ahphp-tool select{width:100%;max-width:420px;padding:8px;border:1px solid #94a3b8;border-radius:8px;font-size:1rem}\n.ahphp-tool .ahphp-out{margin-top:16px;padding:12px 16px;background:#fff;border-left:4px solid #2563eb;border-radius:6px}\n.ahphp-tool button.ahphp-btn{margin-top:16px;padding:10px 20px;border:0;border-radius:8px;background:#2563eb;color:#fff;font-size:1rem;cursor:pointer}\na.ahphp-cta.wp-element-button{display:inline-block;margin-top:12px;color:#fff !important;background:#2563eb !important;text-decoration:none !important;padding:10px 20px;border-radius:8px}\n<\/style>\n<div class=\"ahphp-tool\">\n  <h3>PHP Critical Security Release Readiness Checker<\/h3>\n  <label for=\"ahphp-branch\">Which PHP branch does your site run?<\/label>\n  <select id=\"ahphp-branch\">\n    <option value=\"85\">PHP 8.5<\/option>\n    <option value=\"84\">PHP 8.4<\/option>\n    <option value=\"83\">PHP 8.3<\/option>\n    <option value=\"82\">PHP 8.2<\/option>\n    <option value=\"old\">PHP 8.1 or older<\/option>\n  <\/select>\n  <label for=\"ahphp-host\">Who manages the server your site runs on?<\/label>\n  <select id=\"ahphp-host\">\n    <option value=\"shared\">A shared host manages it<\/option>\n    <option value=\"vps\">I manage a VPS or dedicated server<\/option>\n  <\/select>\n  <button type=\"button\" class=\"ahphp-btn\" data-ahphp=\"check\">Show my next steps<\/button>\n  <div class=\"ahphp-out\" id=\"ahphp-out\" aria-live=\"polite\">Choose your branch and server type, then select the button.<\/div>\n  <a class=\"ahphp-cta wp-element-button\" href=\"https:\/\/www.ahosting.net\/wordpress-hosting.html\">See WordPress hosting plans<\/a>\n<\/div>\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var root = document.querySelector('.ahphp-tool');\n    if (!root) { return; }\n    var out = document.getElementById('ahphp-out');\n    var branchEl = document.getElementById('ahphp-branch');\n    var hostEl = document.getElementById('ahphp-host');\n    if (!out) { return; }\n    if (!branchEl) { return; }\n    if (!hostEl) { return; }\n    var branchText = {\n      '85': 'PHP 8.5 receives security fixes on php.net until 31 December 2029. Update to the fixed point release as soon as PHP publishes it.',\n      '84': 'PHP 8.4 receives security fixes on php.net until 31 December 2028. Update to the fixed point release as soon as PHP publishes it.',\n      '83': 'PHP 8.3 receives security fixes on php.net until 31 December 2027. Update to the fixed point release as soon as PHP publishes it.',\n      '82': 'PHP 8.2 is on security-only support until 31 December 2026. A fix for it is not confirmed, so read the advisory first and plan a move to a newer branch.',\n      'old': 'PHP 8.1 and older are not listed as supported on php.net. Do not wait for a patch. Test your site on a supported branch and move.'\n    };\n    var hostText = {\n      'shared': 'On shared hosting your provider normally installs the patched packages. Your job is to confirm the full version afterwards in MultiPHP Manager and Site Health.',\n      'vps': 'On a VPS or dedicated server nobody updates PHP for you. Update the packages yourself once the fixed version is published, then confirm it with php -v and Site Health.'\n    };\n    root.addEventListener('click', function(ev){\n      var t = ev.target;\n      if (!t) { return; }\n      var action = t.getAttribute('data-ahphp');\n      if (action !== 'check') { return; }\n      var b = branchEl.value;\n      var h = hostEl.value;\n      out.innerHTML = '<p><strong>Branch:<\/strong> ' + branchText[b] + '<\/p><p><strong>Server:<\/strong> ' + hostText[h] + '<\/p><p><strong>Always:<\/strong> take a full backup first.<\/p>';\n    });\n  });\n})();\n<\/script>\n\n\n\n<h3 id=\"aioseo-before-the-php-critical-security-release-four-steps\" class=\"wp-block-heading\">Before the PHP Critical Security Release: Four Steps<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Take a full backup of files and database, and confirm you can restore it.<\/li>\n\n\n\n<li>Record your exact PHP version from Site Health or cPanel.<\/li>\n\n\n\n<li>Test your site on a staging copy running a newer branch. Our guide to <a href=\"https:\/\/www.ahosting.net\/blog\/push-wordpress-staging-to-live\/\">pushing WordPress staging to live<\/a> covers doing that safely.<\/li>\n\n\n\n<li>Check your host for any notice about the maintenance window.<\/li>\n<\/ol>\n\n\n\n<h3 id=\"aioseo-after-the-php-critical-security-release-four-steps\" class=\"wp-block-heading\">After the PHP Critical Security Release: Four Steps<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Read the advisory and find the fixed version for your branch.<\/li>\n\n\n\n<li>Update, or confirm your host has updated, to that version or later.<\/li>\n\n\n\n<li>Reload Site Health and cPanel and confirm the full version string changed.<\/li>\n\n\n\n<li>Test the pages that earn money, such as forms and checkout.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">For stores, the last step matters most. For example, a <a href=\"https:\/\/www.ahosting.net\/woocommerce-hosting.html\">WooCommerce store<\/a> should place a test order, because a PHP change touches payment plugins first.<\/p>\n\n\n\n<h2 id=\"aioseo-which-php-branches-still-receive-security-fixes-after-the-release\" class=\"wp-block-heading\">Which PHP Branches Still Receive Security Fixes After the Release<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Importantly, a fix only reaches branches that PHP still supports. The table below is taken from <a href=\"https:\/\/www.php.net\/supported-versions.php\" target=\"_blank\" rel=\"noopener\">the PHP supported versions page<\/a>, read on 21 October 2026.<\/p>\n\n\n\n<figure class=\"wp-block-table ah-ladder\"><table><thead><tr><th>PHP branch<\/th><th>Active support until<\/th><th>Security support until<\/th><th>Status on 21 October 2026<\/th><\/tr><\/thead><tbody><tr><td>8.2<\/td><td>31 December 2024<\/td><td>31 December 2026<\/td><td>Security fixes only, ending in about ten weeks<\/td><\/tr><tr><td>8.3<\/td><td>31 December 2025<\/td><td>31 December 2027<\/td><td>Security fixes only<\/td><\/tr><tr><td>8.4<\/td><td>31 December 2026<\/td><td>31 December 2028<\/td><td>Active support, ending in about ten weeks<\/td><\/tr><tr><td>8.5<\/td><td>31 December 2027<\/td><td>31 December 2029<\/td><td>Active support<\/td><\/tr><tr><td>8.1 and older<\/td><td>Not listed<\/td><td>Not listed<\/td><td>Not supported by PHP<\/td><\/tr><tr><td>8.6<\/td><td>Not listed<\/td><td>Not listed<\/td><td>Release candidate, not for production<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">AHosting PHP Branch Support Table: dates as listed on php.net, with the 8.6 status from the 8 October 2026 RC3 notice.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, a branch outside the first four rows will not get a patch from PHP. Overall, the choice between current branches is covered in our <a href=\"https:\/\/www.ahosting.net\/blog\/best-php-version-for-wordpress-cpanel\/\">PHP version guide for WordPress in cPanel<\/a>.<\/p>\n\n\n\n<h2 id=\"aioseo-what-to-do-if-the-php-critical-security-release-skips-your-end-of-life-php-version\" class=\"wp-block-heading\">What to Do if the PHP Critical Security Release Skips Your End-of-Life PHP Version<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP has not said which branches the fixes cover. Even so, a branch missing from the supported list gets nothing from this release or the next one. In fact, WordPress already treats that case as critical and labels the version as one that does not receive security updates.<\/p>\n\n\n\n<h3 id=\"aioseo-end-of-life-php-is-still-selectable-on-many-hosts\" class=\"wp-block-heading\">End-of-Life PHP Is Still Selectable on Many Hosts<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, being able to choose an old branch does not make it safe. On our customer servers, the cPanel list of installed PHP versions runs from old branches up to PHP 8.5, so an old branch is one click away. As a result, check what you selected, not what is on offer.<\/p>\n\n\n\n<h3 id=\"aioseo-a-safe-move-off-an-old-php-branch\" class=\"wp-block-heading\">A Safe Move Off an Old PHP Branch<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">First, back up. Second, change the version for one domain in MultiPHP Manager or on staging. Third, load the site, the admin area and every form. Finally, switch back at once if a plugin fails, then update or replace that plugin before trying again.<\/p>\n\n\n\n<h2 id=\"aioseo-who-applies-the-php-critical-security-release-shared-hosting-vps-or-you\" class=\"wp-block-heading\">Who Applies the PHP Critical Security Release: Shared Hosting, VPS or You?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The answer depends on where the PHP packages live. Typically, on shared hosting the provider installs them and you pick the branch. On a VPS or dedicated server, by contrast, you own that job.<\/p>\n\n\n\n<h3 id=\"aioseo-shared-hosting-the-host-patches-you-verify\" class=\"wp-block-heading\">Shared Hosting: The Host Patches, You Verify<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, a shared host updates the PHP packages for all accounts, and your task is to confirm the result. First-hand, the AHosting customer server we inspected runs CloudLinux 9 with CageFS and LVE. Its LiteSpeed PHP processes run as each site&#8217;s own cPanel user, and 38 of them were observed that way on 30 September 2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As a result, an exploited site is confined to what its own account can reach, which is how that isolation is designed to work. However, nobody has published the flaws, so we cannot say whether an exploit would respect that boundary.<\/p>\n\n\n\n<h3 id=\"aioseo-vps-and-dedicated-servers-you-patch\" class=\"wp-block-heading\">VPS and Dedicated Servers: You Patch<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">By contrast, a <a href=\"https:\/\/www.ahosting.net\/vps-hosting.html\">WordPress VPS<\/a> leaves package updates to you. Therefore, schedule the update for the hour after the fixed version appears, and keep a snapshot ready.<\/p>\n\n\n\n<h3 id=\"aioseo-agencies-many-sites-one-version-check\" class=\"wp-block-heading\">Agencies: Many Sites, One Version Check<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For agencies, the work is a list, not a single check. Specifically, record the PHP version of every client site today. Agencies hosting many client sites on a <a href=\"https:\/\/www.ahosting.net\/reseller-hosting.html\">reseller hosting account<\/a> can then update them in one pass instead of site by site.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Finally, once you have confirmed the full version, open a ticket with the PHP version shown under Tools, Site Health, Info, Server and we will look at it with you.<\/p>\n\n\n\n<h2 id=\"faq-php-critical-security-release-october-2026-wordpress\" class=\"wp-block-heading\">Frequently Asked Questions: PHP Critical Security Release<\/h2>\n\n\n\n<h3 id=\"faq-php-vulnerability-2026-wordpress\" class=\"wp-block-heading\">Does the PHP critical security release put my WordPress site at risk in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, any WordPress site runs on PHP, so a critical PHP flaw can reach it whatever plugins it uses. However, PHP has not published the affected versions yet. Therefore, treat every site as exposed until the advisory names fixed versions.<\/p>\n\n\n\n<h3 id=\"faq-php-critical-security-release-date\" class=\"wp-block-heading\">When is the PHP critical security release and could it arrive earlier than planned?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, PHP scheduled the release for Wednesday 21 October 2026 at 14:00 UTC. However, the security team reserved the right to ship earlier if details become public or exploitation appears. As a result, prepare before the stated time, not at it.<\/p>\n\n\n\n<h3 id=\"faq-php-version-wordpress-site-health\" class=\"wp-block-heading\">Does a green PHP check in WordPress Site Health prove the PHP critical security release reached my site?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In fact, it does not. The check compares your PHP version with a recommended version from WordPress.org and shows green at or above it. Therefore, a site on an unpatched point release of a current branch still shows green. Read the full version string instead.<\/p>\n\n\n\n<h3 id=\"faq-php-8-4-vs-php-8-5-security\" class=\"wp-block-heading\">PHP 8.4 vs PHP 8.5: which branch should a WordPress site be on for security support in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, php.net lists security support for 8.4 until 31 December 2028 and for 8.5 until 31 December 2029. Both receive fixes today. However, WordPress plugin compatibility is the practical limit, so test on staging before moving a live site.<\/p>\n\n\n\n<h3 id=\"faq-php-critical-security-release-shared-vs-vps\" class=\"wp-block-heading\">Who applies the PHP critical security release on shared hosting vs a VPS?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Typically, a shared host installs the patched PHP packages and you choose the branch your site uses. On a VPS, by contrast, you or your administrator must update the packages yourself. In practice, ask your provider which of the two applies to your plan.<\/p>\n\n\n\n<h3 id=\"faq-php-critical-security-release-php-82-2026\" class=\"wp-block-heading\">My WordPress site runs PHP 8.2 in 2026, so should I wait for the PHP critical security release patch or upgrade now?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, php.net lists 8.2 with security support only until 31 December 2026. A fix for 8.2 is not confirmed for this release. Therefore, back up, test on staging, and plan the move to 8.3 or later instead of waiting.<\/p>\n\n\n\n<h3 id=\"faq-php-critical-security-release-end-of-life-branch\" class=\"wp-block-heading\">What should I do if my WordPress site runs PHP 8.0 or an older end-of-life branch?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">First and foremost, move to a supported branch, because php.net no longer lists the older ones. WordPress Site Health already flags such versions as critical because they receive no security updates. Consequently, a patch is unlikely to reach them.<\/p>\n\n\n\n<h3 id=\"faq-ahosting-php-version-cpanel\" class=\"wp-block-heading\">How do I check which PHP version my AHosting WordPress site uses in cPanel?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, open MultiPHP Manager in cPanel and read the PHP version listed beside each domain. Alternatively, open Tools, Site Health, Info, Server inside WordPress. In other words, the two views should agree, and a mismatch points to a per-domain override.<\/p>\n\n\n\n<h3 id=\"faq-ahosting-php-isolation-cagefs\" class=\"wp-block-heading\">Does AHosting CageFS limit the damage if a PHP flaw is exploited on one site?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, AHosting customer servers run CloudLinux with CageFS and LVE, and each PHP process runs as the cPanel user that owns the site. As a result, an exploited site is confined to what that account can reach. However, nobody has published the flaws yet, so this is design intent, not a guarantee.<\/p>\n\n\n\n<h3 id=\"faq-ahosting-php-ticket-help\" class=\"wp-block-heading\">How can AHosting help me confirm my PHP version after the PHP critical security release?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, open a ticket with the PHP version shown under Tools, Site Health, Info, Server and we will look at it with you. Additionally, mention your domain so we can compare it with the version cPanel lists for that site.<\/p>\n\n\n\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var allH3s = document.querySelectorAll('h3.wp-block-heading');\n    var inFaq = false;\n    for (var i = 0; i < allH3s.length; i++) {\n      var h3 = allH3s[i];\n      var prev = h3.previousElementSibling;\n      if (prev) {\n        if (prev.tagName === 'H2') {\n          var prevId = prev.getAttribute('id');\n          if (prevId) {\n            if (prevId.indexOf('faq-') === 0) {\n              inFaq = true;\n            } else {\n              inFaq = false;\n            }\n          }\n        }\n      }\n      if (inFaq) {\n        initToggle(h3);\n      }\n    }\n    function initToggle(h3) {\n      var answer = h3.nextElementSibling;\n      if (!answer) { return; }\n      if (answer.tagName !== 'P') { return; }\n      answer.style.display = 'none';\n      h3.style.cursor = 'pointer';\n      h3.setAttribute('tabindex', '0');\n      h3.setAttribute('aria-expanded', 'false');\n      h3.addEventListener('click', function(){\n        toggleOne(h3, answer);\n      });\n      h3.addEventListener('keydown', function(ev){\n        if (ev.key === 'Enter') { toggleOne(h3, answer); }\n        if (ev.key === ' ') { ev.preventDefault(); toggleOne(h3, answer); }\n      });\n    }\n    function toggleOne(h3, answer) {\n      var open = h3.getAttribute('aria-expanded') === 'true';\n      if (open) {\n        answer.style.display = 'none';\n        h3.setAttribute('aria-expanded', 'false');\n      } else {\n        answer.style.display = 'block';\n        h3.setAttribute('aria-expanded', 'true');\n      }\n    }\n  });\n})();\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR The PHP critical security release is due on 21 October 2026 at 14:00 UTC and fixes two flaws rated CVSS 9.2. PHP has not named the affected versions yet, so treat every WordPress site as exposed until it does. Check your full PHP version now, back up, and update as soon as the fixed [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1482,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[8],"tags":[252,323,255,321,324,138,322],"class_list":["post-1481","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress","tag-cpanel-multiphp-manager","tag-php-critical-security-release","tag-php-end-of-life","tag-php-security-update","tag-wordpress-php-version","tag-wordpress-security","tag-wordpress-site-health"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"The PHP critical security release lands 21 October 2026. See what is confirmed, how to check your WordPress site, and why green Site Health is not proof.\" \/>\n\t<meta name=\"robots\" content=\"max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n\t<meta name=\"author\" content=\"Matt Chrust\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"AHosting Blog | WordPress Hosting Tips &amp; Guides\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"PHP Critical Security Release: WordPress Guide | AHosting\" \/>\n\t\t<meta property=\"og:description\" content=\"The PHP critical security release lands 21 October 2026. See what is confirmed, how to check your WordPress site, and why green Site Health is not proof.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/php-critical-security-release-october-2026-wordpress-ahosting.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/php-critical-security-release-october-2026-wordpress-ahosting.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-21T11:36:07+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-21T13:16:15+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@ahostingdotnet\" \/>\n\t\t<meta name=\"twitter:title\" content=\"PHP Critical Security Release: WordPress Guide | AHosting\" \/>\n\t\t<meta name=\"twitter:description\" content=\"The PHP critical security release lands 21 October 2026. See what is confirmed, how to check your WordPress site, and why green Site Health is not proof.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@ahostingdotnet\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/php-critical-security-release-october-2026-wordpress-ahosting.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#article\",\"name\":\"PHP Critical Security Release: WordPress Guide | AHosting\",\"headline\":\"PHP Critical Security Release: What WordPress Site Owners Should Do Now\",\"author\":{\"@type\":\"Person\",\"name\":\"Matt Chrust\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php-critical-security-release-october-2026-wordpress-ahosting.jpg\",\"width\":1200,\"height\":675,\"caption\":\"Green in Site Health is not the same as patched: read your full PHP version. By Matt Chrust, Director of Business Development, AHosting.\"},\"datePublished\":\"2026-10-21T11:36:07+00:00\",\"dateModified\":\"2026-10-21T13:16:15+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#webpage\"},\"articleSection\":\"WordPress, cPanel MultiPHP Manager, php critical security release, PHP end of life, PHP security update, WordPress PHP version, wordpress security, WordPress Site Health\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"position\":2,\"name\":\"WordPress\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#listItem\",\"name\":\"PHP Critical Security Release: What WordPress Site Owners Should Do Now\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#listItem\",\"position\":3,\"name\":\"PHP Critical Security Release: What WordPress Site Owners Should Do Now\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"},\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/\"}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\",\"name\":\"AHosting\",\"description\":\"WordPress Hosting Tips & Guides\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/assets\\\/img\\\/ahosting-logo.svg\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/ahostingdotnet\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\",\"name\":\"Matt Chrust\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Matt Chrust\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#webpage\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/\",\"name\":\"PHP Critical Security Release: WordPress Guide | AHosting\",\"description\":\"The PHP critical security release lands 21 October 2026. See what is confirmed, how to check your WordPress site, and why green Site Health is not proof.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php-critical-security-release-october-2026-wordpress-ahosting.jpg\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#mainImage\",\"width\":1200,\"height\":675,\"caption\":\"Green in Site Health is not the same as patched: read your full PHP version. By Matt Chrust, Director of Business Development, AHosting.\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/php-critical-security-release-october-2026-wordpress\\\/#mainImage\"},\"datePublished\":\"2026-10-21T11:36:07+00:00\",\"dateModified\":\"2026-10-21T13:16:15+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#website\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"name\":\"AHosting\",\"description\":\"WordPress Hosting Tips & Guides\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"PHP Critical Security Release: WordPress Guide | AHosting","description":"The PHP critical security release lands 21 October 2026. See what is confirmed, how to check your WordPress site, and why green Site Health is not proof.","canonical_url":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/","robots":"max-snippet:-1, max-image-preview:large, max-video-preview:-1","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#article","name":"PHP Critical Security Release: WordPress Guide | AHosting","headline":"PHP Critical Security Release: What WordPress Site Owners Should Do Now","author":{"@type":"Person","name":"Matt Chrust","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/"},"publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/php-critical-security-release-october-2026-wordpress-ahosting.jpg","width":1200,"height":675,"caption":"Green in Site Health is not the same as patched: read your full PHP version. By Matt Chrust, Director of Business Development, AHosting."},"datePublished":"2026-10-21T11:36:07+00:00","dateModified":"2026-10-21T13:16:15+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#webpage"},"isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#webpage"},"articleSection":"WordPress, cPanel MultiPHP Manager, php critical security release, PHP end of life, PHP security update, WordPress PHP version, wordpress security, WordPress Site Health"},{"@type":"BreadcrumbList","@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/#listItem","position":1,"name":"Home","item":"https:\/\/www.ahosting.net\/blog\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","position":2,"name":"WordPress","item":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#listItem","name":"PHP Critical Security Release: What WordPress Site Owners Should Do Now"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#listItem","position":3,"name":"PHP Critical Security Release: What WordPress Site Owners Should Do Now","previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"},"item":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/"}]},{"@type":"Organization","@id":"https:\/\/www.ahosting.net\/#organization","name":"AHosting","description":"WordPress Hosting Tips & Guides","url":"https:\/\/www.ahosting.net\/","logo":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/assets\/img\/ahosting-logo.svg","@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#organizationLogo"},"image":{"@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#organizationLogo"},"sameAs":["https:\/\/x.com\/ahostingdotnet"]},{"@type":"Person","@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/","name":"Matt Chrust","image":{"@type":"ImageObject","@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g","width":96,"height":96,"caption":"Matt Chrust"}},{"@type":"WebPage","@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#webpage","url":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/","name":"PHP Critical Security Release: WordPress Guide | AHosting","description":"The PHP critical security release lands 21 October 2026. See what is confirmed, how to check your WordPress site, and why green Site Health is not proof.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#breadcrumblist"},"author":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"creator":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/php-critical-security-release-october-2026-wordpress-ahosting.jpg","@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#mainImage","width":1200,"height":675,"caption":"Green in Site Health is not the same as patched: read your full PHP version. By Matt Chrust, Director of Business Development, AHosting."},"primaryImageOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/#mainImage"},"datePublished":"2026-10-21T11:36:07+00:00","dateModified":"2026-10-21T13:16:15+00:00"},{"@type":"WebSite","@id":"https:\/\/www.ahosting.net\/#website","url":"https:\/\/www.ahosting.net\/","name":"AHosting","description":"WordPress Hosting Tips & Guides","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"}}]},"og:locale":"en_US","og:site_name":"AHosting Blog | WordPress Hosting Tips &amp; Guides","og:type":"article","og:title":"PHP Critical Security Release: WordPress Guide | AHosting","og:description":"The PHP critical security release lands 21 October 2026. See what is confirmed, how to check your WordPress site, and why green Site Health is not proof.","og:url":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/","og:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/php-critical-security-release-october-2026-wordpress-ahosting.jpg","og:image:secure_url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/php-critical-security-release-october-2026-wordpress-ahosting.jpg","og:image:width":1200,"og:image:height":675,"article:published_time":"2026-10-21T11:36:07+00:00","article:modified_time":"2026-10-21T13:16:15+00:00","twitter:card":"summary_large_image","twitter:site":"@ahostingdotnet","twitter:title":"PHP Critical Security Release: WordPress Guide | AHosting","twitter:description":"The PHP critical security release lands 21 October 2026. See what is confirmed, how to check your WordPress site, and why green Site Health is not proof.","twitter:creator":"@ahostingdotnet","twitter:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/php-critical-security-release-october-2026-wordpress-ahosting.jpg"},"aioseo_meta_data":{"post_id":"1481","title":"PHP Critical Security Release: WordPress Guide | AHosting","description":"The PHP critical security release lands 21 October 2026. See what is confirmed, how to check your WordPress site, and why green Site Health is not proof.","keywords":null,"keyphrases":{"focus":{"keyphrase":"php critical security release","score":0,"analysis":[]},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-10-21 11:33:34","updated":"2026-10-21 13:18:37","seo_analyzer_scan_date":null,"focus_keyword":"php critical security release","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/\" title=\"WordPress\">WordPress<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tPHP Critical Security Release: What WordPress Site Owners Should Do Now\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.ahosting.net\/blog\/"},{"label":"WordPress","link":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/"},{"label":"PHP Critical Security Release: What WordPress Site Owners Should Do Now","link":"https:\/\/www.ahosting.net\/blog\/php-critical-security-release-october-2026-wordpress\/"}],"_links":{"self":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1481","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/comments?post=1481"}],"version-history":[{"count":3,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1481\/revisions"}],"predecessor-version":[{"id":1492,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1481\/revisions\/1492"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media\/1482"}],"wp:attachment":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media?parent=1481"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/categories?post=1481"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/tags?post=1481"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}