PHP Security Update

Update timeline

1. identified Oct 21, 2026, 01:40 PM UTC

   As widely reported, two critical vulnerabilities were recently identified in PHP, the core programming language powering WordPress. Our security teams have been actively monitoring the situation and implementing several mitigating actions. As of 8:40 AM CDT (13:40 UTC) today, PHP has begun to release patches and other mitigating steps to resolve the vulnerabilities. Our team is working to roll out these updates across all customer platforms as soon as possible. In addition, we have already deployed protective mitigations at the CDN layer via Cloudflare and Fastly. We will share further updates as deployment progresses.

2. identified Oct 21, 2026, 05:30 PM UTC

   We are currently deploying patches to the platform. Protective mitigations remain active at the CDN layer and at the hosting layer. Further updates will be provided as they are available.

3. identified Oct 21, 2026, 09:52 PM UTC

   We are continuing to deploy patches to our platform, and our proactive mitigations remain in place to help protect customers. All versions of PHP that are running on our platform will be updated, including: 7.4 8.2 8.4 8.5 We will continue to provide updates as they are available.

4. resolved Oct 22, 2026, 01:19 AM UTC

   WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on our platform. The patches have been applied to your PHP version, and no action is needed from you. Updated PHP versions: 7.4.33.17 8.2.35 8.4.27 8.5.12 If you have any additional questions, please reach out to our support team.