# PHP security releases in 2026: which ones affect WordPress

PHP shipped security releases in May, July, September and October 2026. Most of the vulnerabilities live in extensions a WordPress site never touches…

Source: https://webkodingtheme.com/blog/php-security-releases-2026-wordpress/

---

WordPress

# PHP security releases in 2026: which ones affect WordPress

AÖ Arif Özelci · Published 30 Oct 2026 · 6 min read
PHP shipped security releases in May, July, September and October 2026. Most of the vulnerabilities live in extensions a WordPress site never touches; one pair — PHP2Shell, fixed on 21 October — affects almost every PHP site and is being exploited. Here is each release, what it fixed, and whether it matters for WordPress and WooCommerce.

## Which PHP versions are still supported

Branch Status (30 October 2026) Latest release
8.5 Active support 8.5.12
8.4 Active support until 31 Dec 2026, then security fixes 8.4.27
8.3 Security fixes only 8.3.36
8.2 Security fixes only — end of life 31 December 2026 8.2.35
8.1 and older End of life: no releases —
A site on PHP 8.1 or older is receiving no security fixes from the PHP project at all. Sites on 8.2 have two months left; plan the move to 8.3 or newer now, while it is a choice rather than an emergency.

## 21 October: PHP2Shell — affects WordPress, update now

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619: unauthenticated remote code execution, triggered while PHP parses an incoming request, before any WordPress code runs. Confirmed on Apache mod_php, considered likely on FPM and LiteSpeed. CISA lists both as actively exploited. This is the one to act on — see what to do about PHP2Shell .
Two follow-ups the same week: on 23 October PHP published an advisory for CVE-2026-115560, which only applies to code that switches the session serializer at runtime with upload progress enabled — setting session.upload_progress.enabled = 0 covers it, and the fix comes in the next regular release. On 26 October, Windows builds were reissued (8.x.y-1) with Brotli 1.2.1 for CVE-2026-111497, reachable only when an application turns on cURL’s automatic response decompression — Windows servers only.

## 24 September: 8.5.11, 8.4.26, 8.3.35, 8.2.34

CVE What it is Does it matter for WordPress?
CVE-2026-91765 Denial of service in SoapServer Only if the site runs a SOAP server endpoint — rare
CVE-2026-91766 HTTP stream wrapper sends Authorization and Cookie headers on to another site after a redirect Low: WordPress’s HTTP API normally uses cURL, not stream wrappers; matters for code calling file_get_contents() on URLs with credentials
CVE-2026-91768 PHP-FPM listen.allowed_clients ignored for IPv6 Only if you rely on that setting to restrict who can reach FPM
The release also fixed issues in Phar, mysqlnd, filters and OpenSSL certificate-name handling. None of these is known to be exploited, but they are reason enough to stay on the current release rather than skipping a cycle.

## 2 and 30 July

CVE What it is Does it matter for WordPress?
CVE-2026-17543 SQL injection in pg_insert(), pg_update() and related PostgreSQL helpers No — WordPress uses MySQL or MariaDB
CVE-2026-17544 Out-of-bounds write in BCMath bccomp() Rarely: only code using BCMath on untrusted input
CVE-2026-14355 Memory corruption in OpenSSL AES-WRAP-PAD Only code that uses that specific cipher mode

## 7 May: 8.5.6, 8.4.21, 8.3.31, 8.2.31

A batch of fixes across mbstring, SOAP, the standard library, the FPM status page and PDO_Firebird. Mostly relevant to sites using those extensions directly; the FPM status-page fix matters only if that page is reachable from the internet, which it should not be.

## What to do

- Check the PHP version serving your site: Tools → Site Health → Info → Server.
- Make sure it is at least 8.2.35, 8.3.36, 8.4.27 or 8.5.12 — or a distribution package that includes the October fixes.
- On PHP 8.1 or older, or 8.2, plan the upgrade to 8.3, 8.4 or 8.5.
- Restart PHP after every update so the running workers use the fixed code.
- Keep plugins and themes current too: most real-world WordPress compromises still come through extensions, not PHP itself.
Every WebKoding plugin lists the minimum PHP version it needs on its page. [Browse them](/plugins). Browse the plugins →

AÖ
Arif Özelci Builds the WebKoding plugins. Answers support himself.
Share on X LinkedIn Copy link
In this article Which PHP versions are still supported 21 October: PHP2Shell — affects WordPress, update now 24 September: 8.5.11, 8.4.26, 8.3.35, 8.2.34 2 and 30 July 7 May: 8.5.6, 8.4.21, 8.3.31, 8.2.31 What to do
Related PHP2Shell (CVE-2026-109618): what WordPress owners must do “There has been a critical error on this website”: the fix