A Critical PHP Security Fix Lands October 21. Is Your Website Ready?

The PHP security team just gave the internet a one-day warning. On Wednesday, October 21, 2026 at 14:00 UTC (9:00 a.m. Central, 10:00 a.m. Eastern), PHP will ship a security release that fixes two critical vulnerabilities, both rated 9.2 on a 10-point severity scale. Their advice to every PHP user is short: prepare now, so you can upgrade as soon as the release is out.

PHP is the language behind most of the web, including every WordPress site, so this one reaches a lot of businesses that have never thought about what their website runs on. Here are plain answers to the questions owners are going to ask.

What exactly is happening on October 21?

On October 20, PHP posted an advance notice of an upcoming security release. It addresses two critical vulnerabilities, each scored 9.2 under CVSS v4.0, the standard scale the security industry uses to rate how dangerous a flaw is. Anything from 9.0 to 10 sits in the top band, labeled critical.

What we do not know yet matters just as much. The details of both flaws, which versions are affected, and which versions fix them will only be published with the release. Anyone who tells you today exactly what is broken is guessing, and we will not guess in this post either.

Why warn everyone before the fix exists?

So the people responsible for PHP servers can clear their calendars. Hosting companies, IT teams, and developers get a day to line up backups, maintenance windows, and staff, so the patch goes in within hours instead of weeks.

There is a second reason the clock matters. Once a fix is public, attackers can study exactly what changed and work backward to the hole it closes. The time between “patch released” and “patch reverse-engineered” can be short, which is why the window that counts starts Wednesday morning, not whenever someone gets around to it. PHP also says it may release earlier than planned if details of either flaw become public, or if there is evidence they are already being exploited.

Does my website even use PHP?

Very possibly. According to W3Techs, PHP runs 69.3% of all websites whose server-side language is known. WordPress is built on it, and so are Drupal, Joomla, WooCommerce, and Magento. If you log into your site through a “wp-admin” address, manage your hosting through cPanel, or have ever been told your site needs plugin updates, your website almost certainly runs on PHP.

If your site lives on a fully hosted builder like Wix or Squarespace, you do not run or update the server software yourself. Patching it is the platform's job, and there is nothing for you to install. The same is true for a site built and run by SWATS (more on that below).

What if my site runs an old version of PHP?

This is the uncomfortable question, and it is the one most likely to apply to an older small-business site. PHP officially supports four versions right now: 8.2, 8.3, 8.4, and 8.5, and 8.2 only receives security fixes until December 31, 2026. Everything older, including every version of PHP 7 and PHP 5, is end of life. End of life means no more official security fixes, ever.

That is not a small group. W3Techs reports that 27% of PHP websites still run PHP 7, and nearly 8% still run PHP 5. If either of this week's flaws reaches back that far, those sites get no official patch on Wednesday. Some hosting companies and Linux vendors backport fixes to older versions on their own, so the honest move is to ask your host directly whether they do. If the answer is no, your fix is not a patch. It is an upgrade to a supported version, and on an older WordPress site with old plugins and a custom theme, that is a project, not a button.

What should I do before Wednesday?

You do not need to become a security engineer tonight. You need a few answers, a backup, and a plan for Wednesday morning.

• Find your PHP version. It is usually listed in your hosting control panel. In WordPress, go to Tools, then Site Health, open the Info tab, and expand the Server section. Or simply email your host and ask.
• Confirm it is a supported version. That means 8.2, 8.3, 8.4, or 8.5. If you are on anything older, start the upgrade conversation now, not after Wednesday.
• Find out who installs the fix, and when. Ask your host or developer one direct question: “When will the October 21 PHP security release be applied to my site?” Get a time, not a “soon.”
• Make a fresh backup today. A security update is the exact moment you want a clean copy of your site and its database, in case the update breaks something.
• Check your site after the update. Load the homepage, submit your contact form, test a booking or a checkout. A patched site that quietly stopped sending you leads is its own kind of outage.

If you are reading this after the release, the steps are the same. Just do them faster.

Who is actually responsible for installing it?

This is where most businesses find the real gap. On typical shared hosting, the hosting company usually updates PHP for you, but how fast varies, and a site pinned to an older version can stay there until someone asks for an upgrade. On a private server, the update belongs to whoever manages that server: your IT person, your developer, or the agency that built the site years ago and has since moved on. Sometimes the honest answer is nobody.

That is the part worth sitting with. Your website runs on a stack of software owned by other people, and every layer of it (the server, PHP, the CMS, the theme, every plugin) needs someone watching for fixes and applying them on a deadline. We have written about how that security debt compounds and about the WordPress core flaw no amount of plugin discipline could have prevented. This week the layer is PHP itself. If you do not know who is on the hook, you just found the most important item on your list.

Are SWATS websites affected?

No. Smart Websites built by SWATS do not run on PHP. There is no PHP to patch, no cPanel, no server to babysit, and no plugin list to audit, which is part of the SWATS Standard every site we build follows. When a notice like this one goes out, there is nothing for our clients to check and nothing for them to schedule on Wednesday morning.

That is the whole point of SWATS. We build or rescue your website, and keeping it current, secure, and fast is our job, not yours. When something needs to change, you send an email. We make the change, you approve a preview link, and it goes live. Release days like this one become something you read about, not something you manage.

If your site runs on PHP and you would rather never have another week like this, that is a conversation worth having. And if you want to see where your site stands today, run the free SWATS Scorecard and see if you are visible, or invisible, to AI search.

This is the way. 🤖

— Jenaro Diaz, Founder & CEO, SWATS