Note: Your sites are already protected against the recently disclosed PHP security issues. Automattic worked closely with the PHP Security team to ensure that all sites hosted on our platform were protected as soon as possible.
The PHP project has announced a security release scheduled for Wednesday, October 21, 2026 at 14:00 UTC, addressing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Full details, affected versions, and fixed versions will be published by the PHP team at release time.
WordPress VIP is aware of and prepared for this release. No action is required on your part.
Security is foundational to the WordPress VIP platform. Platform components, including PHP, are maintained and updated for you, and our defense-in-depth approach – layered protections across infrastructure, network, and application, backed by continuous monitoring – keeps your sites secure without added effort from your team.
We will continue to monitor the situation and post an update here if anything changes. If you have questions, please reach out via your usual support channel.
How to confirm your PHP version
Your environments run the fixed PHP releases: 8.2.35, 8.3.36, 8.4.27 or 8.5.12, depending on each environment’s PHP version. You can confirm the full version number in any of these ways:
- VIP Dashboard: Go to Software Versions and select the PHP tab. The current version is shown at the top.
- VIP-CLI: Run
vip @example-app.production -- wp --infoand check the PHP version. - Site Health: In the WordPress admin, go to Tools > Site Health > Info and expand Server.
- Query Monitor: In the admin toolbar, open Query Monitor and select Environment.