Critical PHP Security Vulnerabilities: Update Your Servers Immediately

The PHP project strongly urges all PHP users to update their installations as soon as possible. We recommend reviewing every website you manage and ensuring it runs a patched PHP version without delay.

Remote code execution (RCE) allows an attacker to execute their own code on a server. An unauthenticated attack means the attacker does not need to log in first. In its advance notice published on October 20, the PHP security team assigned both vulnerabilities a CVSS v4.0 score of 9.2, placing them in the Critical severity category.

Why WordPress Site Owners Need to Act

Every WordPress site relies on PHP. These vulnerabilities affect PHP itself, rather than WordPress core, plugins, or themes. Consequently, WordPress automatic updates will not resolve the issue. PHP must be patched directly on the server.

Who Is Affected?

According to the PHP security advisory, all PHP installations handling web requests are potentially affected. This includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

The PHP project identifies Apache’s mod_php configuration as the highest-risk scenario, citing a demonstrated exploit that allows an unauthenticated request to trigger an attack before application code begins executing.

Fixed PHP Versions

Upgrade to the following patched releases:

• PHP 8.5: 8.5.12
• PHP 8.4: 8.4.27
• PHP 8.3: 8.3.36
• PHP 8.2: 8.2.35

Note that PHP 8.2 reaches end of life on December 31, 2026. After that date, the PHP project will no longer provide security fixes for this branch. Plan to migrate to a supported PHP version.

PHP 8.1 and earlier are no longer supported by the PHP project. Some Linux distributions and long-term support (LTS) vendors may provide backported security fixes. Check with your operating system vendor or hosting provider, or upgrade to a supported PHP branch.

For users who compile PHP from source or lack access to an LTS vendor, the PHP security team has also published minimal source patches for PHP 7.4, 8.0, and 8.1.

What You Should Do Now

1. Check your current PHP version. In WordPress, navigate to Tools → Site Health → Info → Server. Keep in mind that distributions and LTS vendors may backport security fixes without changing the displayed version number. Consult your provider’s security notice to confirm whether your installation is patched.
2. Contact your hosting provider if PHP is managed for you. Ask them to confirm that the affected PHP installation has been updated to a fixed release or has received the appropriate security patches.
3. Update PHP on servers you manage. Back up your website and database before installing the updated PHP packages provided by your Linux distribution or LTS vendor. These vendors received the patches in advance. If you build PHP yourself or use Windows, consult the official PHP downloads page for the appropriate source packages or binaries.
4. Check for updates if you use remirepo. Users of the volunteer-maintained Remi repository should check for patched packages. The original advisory stated that updates would not be available on October 21, but the PHP Foundation subsequently announced that the repository maintainer was signing updated packages. The advisory also recommends switching to distribution packages or building from source if you need to apply patches immediately.

What If You Cannot Update Immediately?

The PHP project emphasizes that upgrading or applying the appropriate security patches is the only complete solution. Its advisory describes mitigation measures that can reduce exposure to specific attack paths, but these measures do not guarantee that an unpatched installation is safe.

If an immediate update is not possible, consult the official PHP security advisory and follow its instructions carefully.

Action required: Prioritize all production servers running affected PHP versions, verify that the relevant PHP execution environment has been patched, and schedule any necessary upgrades as soon as possible.