PHP CVSS 9.2 Vulnerabilities Impact WordPress; Critical Patch Arrives October 21
Two high-severity vulnerabilities in PHP, both rated 9.2, will be patched in an update scheduled for October 21, 2026, affecting all dependent applications.
Key points
- The PHP team announced a critical security release for October 21, 2026, at 14:00 UTC.
- The update addresses two vulnerabilities, each with a CVSS v4.0 score of 9.2.
- WordPress sites and other PHP-dependent services are directly impacted by these flaws.
The PHP security team announced an upcoming critical release that fixes two vulnerabilities. According to Wordfence, both flaws are rated 9.2 on the CVSS v4.0 scale. The advisory states that PHP is the programming language WordPress is built on. Every WordPress site runs on PHP, meaning these sites are affected by the release. The update is scheduled for Wednesday, October 21, 2026.
How it unfolded
- On October 20, 2026, Alan Coopersmith posted advance notice of the release on the oss-security mailing list.
- The PHP security team scheduled the critical update for Wednesday, October 21, 2026, at 14:00 UTC.
- Wordfence published a public service announcement highlighting the impact on WordPress and other PHP-based platforms.
Who is affected
Any system running PHP is affected by these vulnerabilities. According to Wordfence, every WordPress site relies on PHP, making these platforms particularly vulnerable until patched. The advisory from the oss-security mailing list indicates that the flaws are critical. Service providers managing multiple client sites must verify which environments require immediate attention. The widespread use of PHP means the blast radius is large, requiring coordinated patching efforts across diverse hosting environments.
The fix
The PHP security team will release the fix on October 21, 2026. The update is scheduled for 14:00 UTC, which corresponds to 10:00 AM Eastern time. According to the official advisory, this release specifically addresses the two high-severity flaws. Administrators should plan their maintenance windows to align with this release time. Once the update is available, applying it promptly is essential to mitigate the risk. No workaround has been confirmed in the source material, making the official patch the primary defense mechanism for affected systems.
What made it possible
Teams usually encounter these risks when underlying runtime environments contain logic errors that bypass security controls. These flaws often allow attackers to manipulate how code is interpreted or executed. In intrusion lifecycles, such weaknesses typically serve as the initial access vector, granting remote code execution capabilities.
Security professionals should assess whether their configurations expose sensitive functions to untrusted input. Understanding the general class of technique helps in identifying similar risks in legacy systems. Regular code audits and dependency reviews are standard practices to reduce exposure to such foundational vulnerabilities before they are exploited in the wild.
What to do and how to stay safe: PHP
- Schedule maintenance windows for October 21, 2026, to apply the PHP update as soon as it is released.
- Inventory all servers and applications running PHP to determine the scope of exposure.
- Monitor official PHP channels for the exact release time and any last-minute changes to the schedule.
- Once the vendor provides an update, test it in a staging environment before deploying to production systems.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When is the PHP security update available?
The update is scheduled for release on October 21, 2026, at 14:00 UTC, according to the PHP security team.
How severe are the vulnerabilities in this release?
Both vulnerabilities are rated 9.2 on the CVSS v4.0 scale, classifying them as critical, per Wordfence.
Does this affect WordPress sites?
Yes, according to Wordfence, every WordPress site runs on PHP and is affected by these critical flaws.
