Security
Critical PHP security update: what website owners should do
PHP has announced fixes for two critical vulnerabilities. If your website uses WordPress or another PHP-based system, check your hosting and prepare to act.
What is confirmed
Status checked on 21 October 2026 at 14:40 Amsterdam time (12:40 UTC). This is a pre-release advisory. Check the official PHP notice below for the latest release status.
On 20 October, the PHP security team announced two critical vulnerabilities, each rated 9.2 under CVSS v4.0. Security updates are scheduled for 21 October at 16:00 Amsterdam time (14:00 UTC), with an earlier release possible. At our last check, the official notice had not yet published affected versions, fixed versions or full technical details.
This is a reason to prepare promptly, not proof that your website has been compromised. We are not publishing an affected-version list until it can be verified.
Running WordPress? Check the server, too.
WordPress runs on PHP. The PHP version is managed at the hosting or server level, separately from WordPress, themes and plugins. Updating those alone is not the same as applying a PHP security fix.
Ask your hosting provider which PHP build your site uses, whether it is affected once the advisory is complete, and when the appropriate fix will be applied. Ask for confirmation afterwards. Do not assume managed hosting or automatic WordPress updates have already covered it.
What to do now
Identify your PHP-based websites and applications, starting with those reachable from the internet. Agree who is responsible for the update: your host, developer or IT team.
Prepare a current backup and a recovery plan. Have someone monitor suspicious activity and official security notices. Once the appropriate fix is available, apply it promptly, verify the running version and test important journeys such as forms, logins and checkout.
CERT-EU recommends considering isolation of internet-facing applications if immediate remediation is not feasible. Discuss that decision with your host or security specialist. Monitoring can help detect problems, but does not remove a vulnerability or replace patching.
Concerned about your website? Talk to us.
Email hello@teqqed.com with your website address and, if you know it, your hosting provider. We have capacity to help assess exposure, set up threat monitoring and coordinate patching with your host. Do not send passwords, API keys or other credentials by email.
For an agreed support engagement, we can prepare the update, apply the vendor’s fix as soon as it is available for your hosting environment, and verify the site afterwards. Timing depends on the vendor release, hosting access and the work your site requires. We will agree the scope and next steps with you first.
Considering a move away from WordPress?
We also have capacity to replace WordPress sites with a platform suited to your business, content and maintenance needs. A rebuild is a separate, planned decision, not an emergency substitute for securing your current website. No platform is risk-free. First address the immediate exposure, then decide what a more manageable long-term setup should look like.