How to Check Your WordPress PHP Version and Patch It Before Attackers Do
On October 21, 2026, the PHP team shipped an emergency fix for two flaws that let an attacker run code on your server without ever logging in. No stolen password. No phishing email that someone has to click. If your host is still running an unpatched version of PHP, the door is already open, and nothing on the front of your site will tell you.
The reassuring part: finding out which version you are on takes a few clicks, and checking the rest of what an attacker would poke at takes one scan. This guide covers both, then shows you how to make sure it stops being something you have to remember.
The October 2026 PHP vulnerabilities, in plain terms
Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. Both are the worst kind: they let an attacker run their own code on your server without signing in. That is the difference between someone rattling a locked door and someone already standing in your hallway.
The PHP team released patched versions the same day. If your site is on one of these, you are covered:
| PHP branch | Patched release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
If you are on anything below the patched release in your branch, treat it as exposed until proven otherwise.
What PHP actually does on your site
PHP is the programming language WordPress is built in. It runs on your hosting server, not in the visitor’s browser, and it is what turns a page request into the actual page: pulling your content from the database, loading your theme, running your plugins, sending your forms. When people say “the server,” PHP is a big part of what they mean. A hole in it is a hole in the engine room, which is why these two flaws matter more than a typical plugin bug.
How to check your PHP version in WordPress
You do not need a developer or a single line of code to find your version. WordPress ships with a tool for it.
- Log in to your WordPress dashboard.
- In the left menu, open Tools.
- Select Site Health.
- Open the Info tab.
- Expand the Server section.
- Read the full PHP version number, for example 8.3.36.
Write down the whole number, not just “8.3.” The last digits are the ones that tell you whether you have the October patch.
Then check the doors around it. Your PHP version is one way in. Your plugins, themes, and WordPress core are the others, and they are where most break-ins actually start. The free WP Guard scanner checks all three against known vulnerabilities and flags anything outdated, so you get a plain answer on the parts an attacker tries first.
Which PHP versions are still supported
Patched is not the same as supported. A version can be current today and stop receiving any fixes a few months from now. As of October 23, 2026:
| PHP branch | Support status |
|---|---|
| PHP 8.2 | Security fixes only, until December 31, 2026 |
| PHP 8.3 | Security fixes only, until December 31, 2027 |
| PHP 8.4 | Active support, until December 31, 2028 |
| PHP 8.5 | Active support, until December 31, 2029 |
WordPress recommends PHP 8.3 or higher. If you are below 8.2, you are running a version that no longer gets security fixes at all, which means the next vulnerability like this one will simply never be patched for you.
Updating WordPress is not the same as updating PHP
This is where most site owners get caught. You see “WordPress is up to date” in your dashboard and assume everything underneath it is too. It is not.
PHP lives at the hosting level. Your host decides which versions are available and, often, which one your site runs. WordPress core, your plugins, and your theme are a separate layer that you update from the dashboard. You can have a perfectly current WordPress install sitting on a version of PHP that has not been patched in a year. The dashboard will not warn you, because from WordPress’s point of view, its own house is in order.
A quick patch is not the same as a version upgrade
There are two different jobs hiding behind the phrase “update PHP,” and confusing them is how sites break.
A security patch is a small move inside your current branch, like going from 8.3.30 to 8.3.36. It fixes the hole and changes almost nothing else. This is the one you want done fast.
A version upgrade is a jump between branches, like 8.2 to 8.4. It is a good idea eventually, but it can expose an old theme or an abandoned plugin that was never written for the newer version. That is a planned change, not an emergency one.
For the October vulnerabilities, patch within your branch now. Plan the bigger jump separately, and do it in this order:
- Confirm the scope and have a way to roll back.
- Check that WordPress core, your theme, your plugins, and any custom code are compatible with the target version.
- Test on a staging copy first, never on the live site.
- Apply the change, then verify the live site actually works.
What to test after a PHP update
A patch that fixes the hole but quietly breaks your checkout is not a win. After any PHP change, walk through the things that make you money and the things that let people reach you:
- Contact and inquiry forms, including the notification email that is supposed to land in your inbox.
- File uploads.
- Bookings or appointments.
- Checkout, from cart to payment to confirmation.
- Customer accounts: login and password reset.
- Integrations: your CRM, email platform, anything connected by API.
- Your most important pages, on a phone.
- WordPress admin access.
- Analytics and tracking, so you do not go blind on your numbers.
If a form stops sending or a payment stops confirming, you want to find it, not have a customer find it for you.
Want this as a one-page checklist? Download the WordPress PHP Update Checklist (PDF). It is the list above, branded and ready to print or hand to whoever runs your site.
Do not want to babysit this? That is our job.
Tracking PHP branches and CVE numbers for the rest of your life is a strange hobby to be handed. It is the exact thing we built WP Guard to take off your plate.
- Free scanner. Install the free WP Guard scanner and it checks your plugins, themes, and WordPress core against known vulnerabilities and flags anything outdated. Self-serve, yours to keep, no strings.
- Pro. The same checks, running continuously, so when the next vulnerability lands you hear it from us, early, instead of from whoever found your open door first. See the plans.
- Guaranteed. You stop touching this entirely. We host and manage the stack, we keep WordPress core, plugins, and PHP current, we test after every change, and when something breaks, fixing it is on us, not you.
Running a lot of sites? The same cover scales across all of them on our agency plans.
Common questions
Can I check my PHP version without installing anything?
Yes. Tools > Site Health > Info > Server shows it. If you want to know whether that version is actually exposed, the free scanner will tell you.
Will my host update PHP automatically?
Some do, some leave it to you, and some will move you to a new branch without warning. Do not assume. Confirm what is actually running on your live site, then confirm it is the patched release.
Should I just pick the highest PHP version in my host’s menu?
Not blindly. Jumping branches can break an old theme or plugin. Patch within your current branch first, then plan a tested move to a newer one.
Does the padlock in my browser mean my PHP is safe?
No. The padlock means traffic to your site is encrypted. It says nothing about whether your server is patched. A fully exposed site can still show a padlock.
Does this mean I need a new website?
Usually not. Most sites need the patch and a quick compatibility check, not a rebuild. The rebuild conversation only comes up if you are stuck on software too old to patch at all.
I think I have already been hacked. What now?
Patching a site that is already compromised does not clean it, it just locks a door the attacker is already behind. You need a check for what was left behind first, then the patch. Run the free scanner as a first look, and if you want it handled properly, that is what Guaranteed is for.
Does the free WP Guard scanner check my PHP version?
Not the PHP version itself, that is the one-step Site Health check above. What it does check is the bigger attack surface: your plugins, themes, and WordPress core, scanned against known vulnerabilities and flagged when they are outdated. Read your PHP version from Site Health, run the scanner for everything else, and you have the full picture.
If I am already on WP Guard, am I covered?
On Guaranteed, yes. Keeping the stack patched and tested is our job, not yours. On the free scanner or Pro, you get the visibility and the early warning. Applying the fix is still on you or your host, which is the line Guaranteed is built to cross.