Update PHP in WordPress: do you need a WordPress update too?

Do you need to update WordPress to get a PHP security fix? Usually not. A security release is a patch to PHP itself, so to update PHP in WordPress for a security fix, you or your host patch PHP and leave WordPress alone. You update WordPress first only when you move to a newer PHP version, such as 8.1 to 8.3.

This week it’s urgent. On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws, nicknamed PHP2Shell, that let an attacker run code on a web server without logging in. PHP 8.1 and older get no fix from the PHP project. Below: which kind of update you’re making, how to check your version, and what to do if your host hasn’t patched yet.

PHP2Shell: what the October 21 release fixes

The PHP security advisory covers two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution: someone who never logs in can run their own code on your server. PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. That covers almost every WordPress host.

PHP’s advice is blunt: there are no complete workarounds, and updating is the only safe choice. Security firm watchTowr reports active exploitation attempts against both flaws, so treat this as a job for this week, not next month.

If your host skipped last month’s release too, one update covers both. Patch releases within a PHP version build on each other, so 8.3.36 also carries the September 24 fixes from 8.3.35 (and the matching 8.2, 8.4 and 8.5 releases). Those fixed a flaw in the SOAP extension that Pantheon rated high-severity, plus problems in OpenSSL certificate checks, the HTTP stream wrapper and PHP-FPM, as listed in the PHP 8 changelog.

Patch or upgrade: which PHP update are you making?

There are two kinds of PHP update, and only one of them involves WordPress.

Patching within your version

Nothing in WordPress needs to change. In cPanel you choose the version branch, like 8.3, and the exact patch level arrives through server updates. On shared hosting that’s your host’s job.

On a VPS or dedicated server with WHM, you run the updates. Update the server’s PHP packages (on cPanel servers these are the EasyApache ea-php packages), then restart PHP-FPM. If Apache runs PHP through mod_php, do a full restart, because a graceful reload doesn’t load the new PHP.

Jumping to a newer version

This is when WordPress comes first. WordPress.org’s update guide says to back up, update WordPress, your theme and your plugins, and check the site works before you change PHP. When a version jump breaks something, the cause is usually a plugin or theme, not WordPress core. The steps are further down.

Which PHP version is your site on, and is it still patched?

Check first, because your version decides which kind of update you need. In the WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open Server. The PHP version line shows the exact number, such as 8.3.36.

Dates come from PHP’s supported versions and end-of-life pages. If you’re on 7.4, 8.0 or 8.1, no patch is coming from the PHP project, so you’re in the upgrade scenario. Because these flaws are so serious, PHP did publish minimal source fixes for those three versions, and some Linux vendors backport fixes into old versions. That helps people who build PHP themselves. On ordinary shared hosting, don’t count on it: ask your host, or move to 8.3 or newer.

Plenty of sites are in this spot. mySites.guru says 18% of the WordPress sites it monitors run PHP 8.1 or older.

One catch when reading the number: some Linux distributions backport fixes without changing the version string, so an older-looking number doesn’t always mean an unpatched server. If Site Health still shows an old number after your host says it has patched, ask which build you’re running.

If your host hasn’t patched yet

• Open a support ticket. Ask when they will apply the October 21 PHP security release (CVE-2026-109618 and CVE-2026-109619) to your PHP version. CloudLinux, whose alt-php packages many cPanel hosts use, said on release day that its fixed packages were in preparation.
• Ask about a firewall rule. CloudLinux says its Imunify360 ruleset 8.83 blocks the public exploit and rolls out automatically where its WAF is on. Cloudflare says its firewall rules for the known exploit are available to all customers, including free plans. Both are stopgaps that can miss variations of the attack, not fixes.
• On a server you control, cut the exposure. PHP’s advisory lists interim settings, such as setting session.upload_progress.enabled to 0 and lowering post_max_size. They reduce risk on specific attack paths but don’t make the server safe, so update as soon as packages arrive.

How to update PHP in WordPress to a newer version safely

If you’re on 8.1 or older, or on 8.2 with the end of the year coming, here’s the order to follow.

1. Back up the files and the database, and make sure you know how to restore them.
2. Update WordPress, your theme and every plugin from Dashboard, then Updates. Check the site still works.
3. Clear out old plugins. Delete the ones you don’t use, and look hard at any that haven’t been updated in a long time. Old plugins and themes are where PHP upgrades usually break.
4. Scan for problems. WordPress.org points to the PHP Compatibility Checker plugin. It can miss issues or flag false ones, so treat it as a guide, not a guarantee.
5. Use staging if you have it. If your host offers a staging copy, switch PHP there first.
6. Switch the version. In cPanel that’s Select PHP Version or MultiPHP Manager, depending on your host. Then click through the pages that bring in money: forms, checkout, booking, search. Check the error log.
7. Roll back if needed. If something breaks, switch PHP back, fix or replace the plugin, and try again. If you have to restore a backup, switch PHP back first.

If a site is so old that every upgrade turns into a repair job, a rebuild can cost less than patching it again and again. Our guide to website redesign cost covers what that runs.

Which PHP version to choose

WordPress requires PHP 7.4 or later and recommends 8.3 or greater. The WordPress core team documents full support for PHP 8.4 from WordPress 6.8 and for PHP 8.5 from WordPress 6.9. For most business sites we’d pick PHP 8.4 when your plugins support it: it gets security fixes until the end of 2028, a year longer than 8.3.

Related guides: Website redesign cost in 2026: what small businesses pay and How to sell car parts online: website, Shopify, eBay and more.

Frequently asked questions

Do I need to update WordPress to get PHP security fixes?

No. Security releases such as PHP 8.3.36 are patches to PHP itself, and WordPress doesn’t change to receive them. On shared hosting your host applies them; on a VPS you update the server’s PHP packages. You update WordPress, plugins and your theme first only when you switch to a newer PHP version, such as 8.1 to 8.3.

How do I check if my host applied the October 2026 PHP security patch?

In WordPress, go to Tools, then Site Health, then the Info tab, and open Server. The PHP version line should read 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. Some hosts backport fixes without changing the version number, so if yours still shows an older number, ask your host which build you’re on.

Is PHP 8.1 still safe for WordPress?

WordPress still runs on PHP 8.1, but the PHP project stopped security fixes for it on December 31, 2025, so 8.1 doesn’t get the October 2026 patch. WordPress.org warns that end-of-life PHP versions may expose your site to security vulnerabilities. Move to PHP 8.3 or 8.4.

Which PHP version should WordPress use in 2026?

PHP 8.3 or newer. WordPress recommends 8.3 or greater, fully supports PHP 8.4 from WordPress 6.8 and PHP 8.5 from WordPress 6.9. PHP 8.4 gets security fixes until December 31, 2028, so it’s a good pick when your plugins support it.

Want a second pair of eyes on your site?

If you’d like someone to check your PHP version, plugins and hosting before you switch, book a free call with IGNITE. We build WordPress sites for shops, dealers and online stores (see our website design work), and we’ll tell you what to update first. It’s 30 minutes, or call us at 440-490-6280.