What PHP fixed on October 21
On October 21, 2026, the PHP project released four new versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical flaws that can let someone run their own code on a web server without logging in. A website can't have a much worse kind of hole than that.
If your site runs on WordPress, it runs on PHP. WordPress shows your PHP version in its own dashboard. You may never have heard the name, and that is fine. What matters is the version number your server is on.
PHP says every installation that serves web pages is at risk, including common server setups such as PHP-FPM, Apache with mod_php and LiteSpeed. You don't need to know what those names mean. Whatever the setup, if your site serves pages with PHP, it is at risk until it is updated. The details are on PHP's news archive.
The holes are old. According to TechCrunch, they have been in every version of PHP since version 5, which came out in 2004. TechCrunch also reports that security teams found them with AI tools, and that the Wiz team used Gemini 4 Argon and GPT-5.6 Sol, among others. You can read that in TechCrunch's report on the PHP holes.
Attacks started before the fix
Amazon's threat team spotted an attempt to exploit the flaws on October 17, 2026, four days before they were made public. AWS calls the pair of flaws PHP2Shell and says they are now being exploited widely. The write-up is on the AWS security blog.
That timing changes how you should treat this. An unpatched site is not waiting for some future attacker. People are already looking for unpatched servers.
The NSA told organizations that use PHP to update right away or take their systems offline until they can. For a shop or an office, taking the site down costs real money. That such blunt advice was given at all tells you how seriously to take this one.
Which versions are safe and which never will be
Each line of PHP has its own fixed version. Find your line, then check that your number is at least this one:
- PHP 8.5: safe on 8.5.12 or newer.
- PHP 8.4: safe on 8.4.27 or newer.
- PHP 8.3: safe on 8.3.36 or newer.
- PHP 8.2: safe on 8.2.35 or newer, but PHP says 8.2 reaches end of life on December 31, 2026, and gets no security fixes after that.
- PHP 8.1 and older: the PHP project sends no fix for these versions, though PHP notes that some distributions and long-term support vendors provide backported fixes, so ask your host.
There is no full workaround. PHP and AWS both say updating to a fixed version is the only complete fix. A security plugin or a firewall setting does not replace the update, so don't let anyone sell you one as the answer.
If you are on 8.2, take the patch now. Then plan the move to a newer line before the end of the year, while 8.2 still gets fixes.
How to check your own site
On WordPress
- Log in to your WordPress dashboard.
- In the sidebar menu, open Tools, then Site Health.
- Select the Info tab.
- Find the PHP version in the list on that tab.
- Compare the number with the list above.
Write the number down with today's date, so you have it when you talk to your host.
On any other site
PHP lives on your web server, not inside your site, so you update it in your host's settings or ask your host to do it for you. If someone else set up your hosting, that person or company is who you ask. Ask by email, so the answer is in writing.
Before anyone changes the version, WordPress advises making a backup, so you can put the site back the way it was if something goes wrong. This applies whatever your site is built on.
If your host says the site is already on a fixed version, ask for the exact number. A general yes doesn't tell you anything you can check against the list above.
What to do
- If you're on WordPress, check your PHP version today under Tools, then Site Health, then the Info tab.
- If the number is older than the fixed version for your line, make a backup, then update PHP in your host's settings or ask your host to do it.
- If you're not on WordPress, email your host or developer today. Ask which PHP version the site runs and when it will be on a fixed one, and ask for a written answer by the end of this week.
- If you're on 8.1 or older, ask your host whether it has a backported fix, and if it does not, ask for a move to a supported line.
- If you're on 8.2, set a reminder for early December to plan the move off it before December 31, 2026, the end-of-life date PHP gives for 8.2.
- Don't accept a plugin or a firewall setting in place of the update.
If you'd rather someone else watched for updates like this, every site we build comes with a warranty, and the pricing page explains the care plan.