A Critical PHP Flaw Was Patched This Week. Here's How to Check Your WordPress Site.
What happened
PHP is the programming language that runs WordPress code on your web server. According to Search Engine Journal, PHP released emergency fixes on October 21, 2026 for two critical flaws that let attackers run code on a web server without logging in.
The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The check below tells you which PHP version your WordPress site is running so you can ask your host to confirm both fixes.
How to check your PHP version in two minutes
In your WordPress dashboard, open Tools > Site Health > Info > Server. Look for the PHP version and note the full version number.
- Open Tools, then Site Health.
- Select Info.
- Open Server and find the PHP version.
Compare it with the fixed versions reported by Search Engine Journal: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Then ask your host to confirm that the version running your site covers both fixes.
Why updating WordPress doesn't fix this
Updating WordPress or plugins does not update PHP. A WordPress update and a PHP update are separate things.
Do not use an up-to-date WordPress dashboard as confirmation that these PHP flaws are patched. Check the PHP version under Site Health and ask your host to confirm both fixes.
What to ask your host
Send your host the version number you found and ask:
“My WordPress site reports PHP version [the version I found]. Can you confirm that the PHP version running my site covers both critical flaws patched on October 21, 2026? Search Engine Journal lists the fixed versions as 8.5.12, 8.4.27, 8.3.36 and 8.2.35.”
Ask for confirmation covering both fixes, not just confirmation that WordPress or your plugins are updated.
If you're on PHP 8.1 or older
Search Engine Journal reports that PHP 8.1 and older are end of life. If that is the version Site Health shows, ask your host to move the site to a supported PHP version covering both fixes.
Include the full PHP version number in your request. Updating WordPress or plugins will not change it.
After the patch: check for a break-in that already happened
After patching, look for unfamiliar admin accounts and unexpected PHP file changes. These are the checks Search Engine Journal recommends after the fixes.
Confirming a fixed PHP version is one step. Checking for signs of a break-in that already happened is a separate step.
Common questions about the PHP fixes
Where do I check my WordPress site’s PHP version?
In WordPress, go to Tools > Site Health > Info > Server and look for the PHP version.
Which PHP versions contain the fixes?
According to Search Engine Journal, the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ask your host to confirm a fixed version covering both fixes.
Does updating WordPress or plugins update PHP?
No. Updating WordPress or plugins does not update PHP. Ask your host to confirm the PHP version running your site.
What if my site is on PHP 8.1 or older?
Search Engine Journal reports that PHP 8.1 and older are end of life. Ask your host to move your site to a supported PHP version covering both fixes.
What should I check after patching?
After patching, look for unfamiliar admin accounts and unexpected PHP file changes.