Self-hosted WordPress: how to apply the October 2026 PHP security update
Short answer
On your own server, the update is yours to apply. 1. Find which PHP serves your website (Site Health shows the version and the SAPI; the command line may use another). 2. Install the patched release from your source: your distribution’s or vendor’s updated packages, or PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 if you build from source. 3. Restart the PHP workers (PHP-FPM) or the web server (mod_php), so the old code is no longer in memory. 4. Confirm in Site Health that the version changed. On PHP 8.1 or older, use a vendor backport now and plan the upgrade.
1. Find the PHP that serves your website
WordPress’s Tools → Site Health → Info → Server shows the PHP version and PHP SAPI of the PHP serving your pages (how to read it). php -v on the command line can report a different installation (why). Note both, and which service runs PHP for the web: PHP-FPM (fpm-fcgi) or Apache with mod_php (apache2handler).
2. Install the patched release
php.net: “Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages.” (php.net)
- Packages from your distribution or a repository: install their security update. Package versions may keep their own numbering; the distribution’s security notice tells you which package fixes the two CVEs.
- Built from source: build PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 from php.net’s downloads.
- PHP 7.4, 8.0, 8.1: no official release. Use your vendor’s backport, or the PHP team’s source backports if you build yourself, and plan an upgrade (the backports).
On a Debian or Ubuntu server with distribution packages, the usual sequence looks like this; service names depend on your PHP version and setup:
Terminal · a typical sequence on Debian or Ubuntu with distribution packages; not run by us, adapt the service name to your setup
sudo apt update
sudo apt upgrade
sudo systemctl restart php8.3-fpm # if PHP runs as PHP-FPM
sudo systemctl restart apache2 # if PHP runs inside Apache (mod_php)3. Restart every PHP worker
A running PHP worker keeps the code it loaded. Until it restarts, it serves pages with the old PHP. Restart the PHP-FPM service, or Apache for mod_php, and any other PHP service on the server. php.net’s advisory stresses the same for its interim settings: “restart every worker”.
4. Confirm
Reload Site Health → Info → Server: the PHP version should show the patched number, or your distribution’s fixed package. Then open your site’s important pages.
Interim settings
If you can’t update right away, php.net lists settings that reduce exposure without fixing the flaws: PHP2Shell mitigations explained. And the related advisory of 23 October: CVE-2026-115560.
While you’re at it
If the server still runs PHP 8.2, its security fixes end on 31 December 2026. A move to 8.3 or 8.4 is a series change: check your plugins and theme first. CompatNav, free on wordpress.org, does that on your server (which version).
Key takeaways
- Update the PHP that serves the website: check Site Health, not just php -v.
- Take the patched packages from your distribution or vendor; php.net says they received the patches in advance.
- Restart PHP-FPM or Apache afterwards: running workers keep the old code.
- Confirm in Site Health that the version changed (or that your package contains the fix).
- A patch in the same series doesn’t need a plugin check; a series change does.
Frequently asked questions
php -v shows the new version but Site Health doesn’t. Why?
The command line and the web server can use different PHP installations, or the web server’s workers weren’t restarted. Restart PHP-FPM or Apache, then look again.
My distribution’s package shows an older number. Is it patched?
Distributions often backport fixes and keep their own version numbers. Check your distribution’s security notice for CVE-2026-109618 and CVE-2026-109619.
I use Docker. What changes?
Rebuild your images on a patched PHP base image and redeploy the containers; restarting an old image doesn’t update PHP.
Check your own site before you upgrade
CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.
Sources
About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.