trydabble
All security updates

Patchpad / PHP

How to check your PHP version and get the October 2026 fix

Last verified (KST)

PHP runs underneath WordPress and many other sites, often managed by your host. The version your site uses can differ from the one on the command line, and a host can fix PHP without changing the number.

WordPress sites: this time, PHP is what needs updating

If you run WordPress: WordPress.org says no WordPress update is needed for these PHP fixes; updating PHP is what counts. In WordPress you can see your PHP version under Tools → Site Health → Info → Server.

See the WordPress pageWordPress.org notice (2026-10-21)Published

This page doesn't scan any site. It explains how to check your own.

What happened

On 21 October 2026 (23:00 KST), PHP released fixes for two critical bugs in PHP itself. They affect PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, whatever app runs on top, WordPress included. In PHP's words: “All PHP users are strongly encouraged to update immediately.” It is widely nicknamed “PHP2Shell”; that is an unofficial name PHP itself does not use. www.php.net

Recent advisories

If your version starts with the number on the left, you need the one on the right or later.

AdvisoryRating (vendor)Fixed in
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (October 2026)CVE-2026-109618, CVE-2026-109619Vendor advisorywww.php.netAlso: PHP security advisory GHSA-w8hw-w9fx-j79w, PHP security advisory GHSA-6wmf-4rv5-p3rp, ChangeLog-8.php, CVE-2026-109618 (cve.org), CVE-2026-109619 (cve.org)Published2026-10-21Last verified2026-10-22 (KST)Rating (vendor)

Critical

CVSS v4.0 9.2

Fixed in
  • 8.5:8.5.12or later
  • 8.4:8.4.27or later
  • 8.3:8.3.36or later
  • 8.2:8.2.35or later

8.1 and older: no official PHP release. Distributions and long-term support vendors may ship their own fix. For people who build from source, the PHP security team provided minimal source backports for PHP 7.4, 8.0 and 8.1. PHP 8.2 reaches end of life on 2026-12-31.

PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 (September 2026)CVE-2026-91768, CVE-2025-1218, CVE-2026-91769, CVE-2026-91767, CVE-2026-6103, CVE-2026-91765, CVE-2025-14181, CVE-2026-92842, CVE-2026-91766, CVE-2026-93682, CVE-2026-17545An earlier security release. The October 2026 releases include these fixes too.Vendor advisorywww.php.netAlso: ChangeLog-8.phpPublished2026-09-24Last verified2026-10-22 (KST)Rating (vendor)

See vendor page

PHP: “security release”

Fixed in
  • 8.5:8.5.11or later
  • 8.4:8.4.26or later
  • 8.3:8.3.35or later
  • 8.2:8.2.34or later

How to check your version

Hosting panel

  • Hosting panels such as cPanel (Select PHP Version or MultiPHP Manager) and Plesk show the PHP version for each site.

Admin screen or project files

  • WordPress sites: Tools → Site Health → Info → Server shows the PHP version the site really uses.

Command line

  • Run this on the server. The command line and the web server can use different PHP builds, so trust the panel or Site Health for the site itself.

    php -v

  • A temporary phpinfo() page also shows the version. If you make one, delete it right after: it shows server details to everyone.

How to update

Your host or platform runs it

  • Managed or shared hosting: ask your host. PHP says Linux distributions and long-term support vendors received the patches in advance. www.php.net

  • A distribution can patch PHP without changing the version number. If the number looks old, ask your host or check your vendor's advisory or package changelog.

You run the server

  • Self-hosted: install your distribution's updated PHP package, then restart every PHP process (PHP-FPM, Apache) so the fix is loaded.

  • Containers: pull or rebuild the image with the fixed PHP and recreate the container.

  • If you use the volunteer Remi repository: PHP noted on 2026-10-21 that it would not have updates that day and suggested distribution packages or building from source. www.php.net

If you can't update yet

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (October 2026)

In PHP's words: “There are no complete mitigations, updating is the only safe choice.” PHP also lists settings that reduce some paths but “do not make an installation safe”. They are for whoever runs your server. www.php.net

For your server admin
  • Set memory_limit=-1 so that it cannot be overridden.
  • Keep post_max_size low.
  • Limit memory with container or cgroup limits (not RLIMIT_AS or RLIMIT_DATA).
  • Set session.upload_progress.enabled=0, then restart the PHP workers.
  • On PHP 8.5, set fatal_error_backtraces=0.

What to ask your host

Copy this, fill in the brackets and send it through your host's support channel.

Hello, my site [your domain] is hosted with you. On 21 October 2026 PHP released security fixes (8.5.12, 8.4.27, 8.3.36 and 8.2.35; CVE-2026-109618 and CVE-2026-109619). Could you tell me which PHP version my site uses and whether it already includes these fixes, including distribution backports? If not, when will it be updated, and do the PHP workers need a restart? Thank you.

Vendor sources

Last verified (KST)