On 21 October 2026 PHP published emergency security fixes for the software that runs most websites, including WordPress. If we host your site, the update was applied that night, minutes after the fixed versions were released.
What was announced on 21 October 2026
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These are security releases. They fix two critical issues in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 (sometimes called PHP2Shell in security reporting).
In plain language: a website still running an unpatched version could be attacked over the internet by someone who is not logged in. The risk sits in the server software, not in a theme, a plugin, or a password you can change in WordPress.
PHP’s own advice was direct. There is no complete workaround. Installing the patched version, then restarting PHP, is the fix. Older branches (PHP 8.1 and earlier) no longer get normal updates from the PHP project, so a site stuck on those versions needs a supported release, not a small plugin tweak.
Why this matters for a normal business website
WordPress, and a lot of other sites we build for agribusiness, run on PHP. The public pages can look fine while the server underneath is out of date. A WordPress dashboard update does not install this PHP fix. That work happens on the hosting server.
The issues affect PHP when it is serving web pages (the usual setup for a public site). Security agencies later listed both issues as known to be exploited. The US Cybersecurity and Infrastructure Security Agency urged organisations to patch immediately, and added both issues to its known-exploited list on 26 October 2026.
What Artikel & Swint did
We host client websites. When the patched PHP versions were released on 21 October 2026, we applied them across that hosting the same night. The updates were finished within minutes of the fixed packages being available, before the next working day.
If your website is on our hosting, you did not need to log in, click an update, or take the site offline yourself. That overnight pass is part of looking after the sites we run.
If your website is hosted somewhere else, ask that host whether PHP is on 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a newer release in that line. If they cannot say, or the version is older, treat it as unfinished work.
What you do not need to do
- You do not need to change your WordPress password because of this announcement.
- You do not need a new theme or a “security plugin” as a substitute for the PHP update.
- You do not need to republish pages or resend email campaigns.
A current backup and a host who will apply server updates quickly still matter. This release is a clear example of why.
If you want us to check a site we do not host
We can confirm the PHP version, plan a move onto a supported release, and fold that into normal website development work. Get in touch and tell us who hosts the site.