PHP security flaw: check your version, PHP update, emergency line
What is known about PHP security, with sources and dates: how to check the PHP version of your website, which versions still receive security updates, and what Coday offers, from the PHP update to maintenance and the emergency line.
In short: The PHP flaws of October 2026 are in PHP itself, not in WordPress: updating WordPress, plugins or the theme does not close them. Ask your hosting provider first whether PHP on your package has been updated, and check the PHP version of your website. If your PHP branch no longer receives security updates, or soon will not, an update is due. Coday handles the PHP update at a fixed price after a free check, ongoing maintenance, the emergency line and, if you want, a rebuild without PHP.
Emergency line: reachable around the clock, including nights and weekends
I work on my own. If I do not pick up, send me the address of your website and what happened through the emergency form on codayweb.de; I get back to you as soon as I see the message. I do not promise a fixed time for my reply.
On 21 October 2026 the PHP project released emergency updates for two critical security flaws that became known as “PHP2Shell”. They can let attackers run code on a web server without logging in. [3][4][5]
The PHP project rates both flaws at 9.2 out of 10 (CVSS 4.0). [6][1][2]
The flaws are in PHP itself, not in WordPress, its plugins or the theme. According to the BSI, updating the application is therefore not enough; the PHP version on the server has to be updated. [7][8][4]
The flaws are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and in packages into which a Linux distribution or a long-term support vendor has applied the fixes. PHP 8.1 and older no longer receive official updates from the PHP project; for 7.4, 8.0 and 8.1 the security team only published fixes to the source code, not new releases. [3]
PHP 8.2 receives security updates from the PHP project only until 31 December 2026. [9]
According to the BSI, all known PHP versions back to at least PHP 5 are affected. [10][11]
The BSI rates the criticality as “3 / Orange”: action must be taken without delay. [7]
Security firms have observed attack attempts. As of 22 October 2026, the BSI knew of no successful attacks on a broad scale. [4][5][10]
According to the BSI, various websites in Germany were harder to reach on 21 October 2026 because some operators had disconnected their servers from the internet as a precaution. In Hesse, too, public authorities took websites offline as a precaution. [7][12]
Addendum of : On 23 October 2026 the PHP project published a further notice about the upload progress setting. It considers the affected setup unlikely and recommends the setting session.upload_progress.enabled=0 until the next regular update. The PHP project has announced the full advisory for it (CVE-2026-115560) for the next regular release. [13]
Check
Checking your PHP version: four steps
The first steps cost nothing and work whether or not you ever talk to Coday.
01
Ask your hosting provider first
Ask your hosting provider first whether PHP on your package has been updated. On shared hosting it is usually the provider who applies the update; IONOS, STRATO, Hetzner and netcup have reported that their web hosting packages are protected against these flaws (as of 22 October 2026). On a server of your own, such as a VPS or a root server, you or your administrator apply the update. [14][15][16][17]
02
Find out your PHP version
In WordPress, Site Health under Tools shows the PHP version; at your hosting provider, the customer area shows it in the settings of your package. The free instant check shows whether your home page reveals the version publicly; many sites reveal none.
The table below shows, for each PHP branch, until when the PHP project provides security updates and which version fixes the flaws named above. If your branch no longer receives security updates, it is time to move to a newer version.
04
Plan a PHP update, not just a WordPress update
A WordPress update does not close these flaws; they are in PHP itself. If your hosting provider has not updated PHP yet or your branch no longer receives updates, the site needs a PHP update: a backup first, then a test whether the theme and plugins run on the new version. [10][8][4]
Versions
Which PHP versions still receive security updates
The table shows, for each PHP branch, such as PHP 8.2 with all versions 8.2.x, until when the PHP project provides security updates, as stated on php.net. [18][19]
PHP branch
Security updates until
At least this version
Status on 23 October 2026
PHP 8.5
Security updates until
At least this versionPHP 8.5.12
Status on 23 October 2026receives security updates
PHP 8.4
Security updates until
At least this versionPHP 8.4.27
Status on 23 October 2026receives security updates
PHP 8.3
Security updates until
At least this versionPHP 8.3.36
Status on 23 October 2026receives security updates
PHP 8.2
Security updates until
At least this versionPHP 8.2.35
Status on 23 October 2026security updates only until 31 December 2026
PHP 8.1
Security updates until
At least this versionno new release from the PHP project
Status on 23 October 2026no security updates any more
PHP 8.0
Security updates until
At least this versionno new release from the PHP project
Status on 23 October 2026no security updates any more
PHP 7.4
Security updates until
At least this versionno new release from the PHP project
Status on 23 October 2026no security updates any more
“At least this version” is the lowest version of the branch that fixes the flaws with the identifiers listed above. What applies to an addendum is stated in the addendum itself.
The flaws are also fixed in packages into which a Linux distribution or a long-term support vendor has applied the fixes, and some hosting providers apply fixes without changing the number. Only your hosting provider can tell whether your package is one of them. [3]
What the end of PHP 8.2 support means for WordPress sites and what hosting providers charge afterwards is explained in the guide.
PHP update, maintenance and emergency line
What Coday offers
Coday is a one-person business in Wetzlar. I bring existing WordPress and PHP sites onto a supported PHP version, keep them up to date through maintenance, help through the emergency line and, if you want, rebuild without PHP.
PHP update at a fixed price
I check which PHP version your site runs on and whether the theme and plugins work with a newer one, coordinate the update with your hosting provider and test it on a copy of the site first. I name the fixed price and the start date after the check, before I start.
Price on request
The offer is for businesses, associations and the self-employed.
Emergency line: reachable around the clock, including nights and weekends
I work on my own. If I do not pick up, send me the address of your website and what happened through the emergency form on codayweb.de; I get back to you as soon as I see the message. I do not promise a fixed time for my reply.
If your website is down, broken after an update or hacked, I help through the emergency line, from saving the infected state to restoring a clean backup.
It covers:
save a copy of the infected state before I change anything
put the website behind a maintenance page
secure the accounts and have the passwords changed
remove malicious code
apply the PHP update or have the hosting provider switch it
restore a clean backup
talk to your hosting provider
I only work with your instruction and with access you give me. I look for the way in as far as logs and files show it; forensics that will stand up in court is a job for a specialist. On the reporting duty, a lawyer or your data protection officer advises you.
I tell you what the job costs before I start.
Price on request
The offer is for businesses, associations and the self-employed.
Updates for WordPress, plugins and the theme, the PHP version at your hosting provider on a supported release, a backup before every update and monitoring of whether the site is reachable. Also for sites another agency built; your hosting stays with your hosting provider.
Monthly price after a free check, price on request
The offer is for businesses, associations and the self-employed.
A site without PHP code, hosted with a provider that runs no PHP, does not execute the code of these flaws. I remove old PHP installations in the same hosting package during the move. That does not make a website unhackable, because nothing does: Next.js needs updates too: on 3 December 2025 the React team disclosed a critical flaw in React Server Components (CVE-2025-55182) that also hit Next.js. [20]
The new site is built with Next.js or with plain HTML, CSS and JavaScript without a framework.
Price on request: the fixed price is in the quote before the work starts.
The offer is for businesses, associations and the self-employed.
Send me the address of your website and what happened, by phone, WhatsApp or through the form.
Emergency line: reachable around the clock, including nights and weekends
I work on my own. If I do not pick up, send me the address of your website and what happened through the emergency form on codayweb.de; I get back to you as soon as I see the message. I do not promise a fixed time for my reply.
Name, phone or e-mail, and in the message the address of your website and what happened. The offer is for businesses, associations and the self-employed.
Frequently asked questions about PHP security
Is it enough to update WordPress and the plugins?
No, not for flaws in PHP itself. The flaws for which the PHP project released emergency updates on 21 October 2026 are in PHP, not in WordPress, its plugins or the theme. According to the BSI, updating the application is therefore not enough; the PHP version on the server has to be updated. On shared hosting, the hosting provider usually does that.
How do I find out which PHP version my website runs on?
In WordPress, Site Health under Tools shows the PHP version; at your hosting provider, the customer area shows it in the settings of your package. The free instant check by Coday reads whether your home page reveals the version publicly. Many sites reveal none, and a visible number is not a finding yet: some hosting providers apply fixes without changing the number.
What happens to PHP 8.2 after 31 December 2026?
The PHP project provides security updates for PHP 8.2 until 31 December 2026 and none after that. Some hosting providers offer extended support for older versions at an extra charge, others switch to a newer version. Ask your hosting provider what it plans for your package, and plan the update so that the theme and plugins are tested on a copy first.
What does a PHP update cost at Coday?
That depends on how many plugins and customizations the site has and whether the theme and plugins work with the new PHP version. That is why I check the site first, free of charge. I name the fixed price and the start date after the check, before I start.
Is the emergency line reachable at night and on weekends too?
Yes, phone and WhatsApp stay switched on at night and on weekends too. I work on my own. If I do not pick up, send me the address of your website and what happened through the emergency form on codayweb.de; I get back to you as soon as I see the message. I do not promise a fixed time for my reply. I tell you what the job costs before I start.
Does the emergency line also help if my website has already been hacked?
Yes. It covers: save a copy of the infected state before I change anything; put the website behind a maintenance page; secure the accounts and have the passwords changed; remove malicious code; apply the PHP update or have the hosting provider switch it; restore a clean backup; talk to your hosting provider. I only work with your instruction and with access you give me. I look for the way in as far as logs and files show it; forensics that will stand up in court is a job for a specialist. On the reporting duty, a lawyer or your data protection officer advises you.
Do I have to move to a website without PHP now?
No. For most sites the PHP update is the right first step, and with regular maintenance a WordPress site stays up to date. A rebuild with Next.js or with plain HTML, CSS and JavaScript is worth it if the site is due for renewal anyway or if the theme and plugins do not work with a current PHP version. A site without PHP needs updates too.
Request a PHP update: fixed price after a free check
Tell me the address of your website. I check for free which PHP version it runs on and what an update needs, and then name the fixed price and the start date before I start. The offer is for businesses, associations and the self-employed.
01
Send a quick request
Name, phone or e-mail and the address of your website.
02
Free check
I look at the PHP version, the theme and the plugins and talk the way forward through with you.
03
Fixed price before work starts
I name the fixed price and the start date after the check, before I start.
Price on request, fixed before work starts
Free and non-binding check
Personally from the owner
Personal reply from the owner
Quick request
Three fields are enough. I will get back to you in person.
Never miss new articles on web development, SEO and Next.js: add Coday as a preferred source in Google Search to see our content more often in Top Stories and AI Overviews.