Home / Guides / Website Security
Website Security · 4 min readPHP and WordPress Security Fixes: October 2026 Roundup
The PHP and WordPress security fixes from October 2026 in plain English: what changed, which versions are safe, and what to update on your site today.
October 2026 was a busy month for website security: PHP shipped urgent fixes for two critical holes, WordPress put out two security releases, and two popular backup plugins patched serious bugs. If you run a WordPress site, the short answer is: update PHP, update WordPress to 7.1.4, and update your plugins. This post explains each fix in plain words and points to the official notice for each one.
The big one: PHP security fixes (October 21)
PHP is the programming language that runs WordPress and many other websites. It lives on your web server, not inside WordPress, so your host or server admin updates it.
On October 21, 2026, the PHP team released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two holes it called critical (PHP.net, Oct 21 2026). The two issues are listed as CVE-2026-109618 and CVE-2026-109619. A CVE is just a public ID number for a known security hole. The PHP team rated both 9.2 out of 10 and said they "can allow unauthenticated remote code execution." In plain words: someone who is not logged in could, in some cases, run their own code on your server.
The PHP team was clear: "updating is the only safe choice." On October 26, the US agency CISA added both holes to its list of flaws known to be used in real attacks (CISA KEV, Oct 26 2026).
We cover this one in more detail in our post on the critical PHP update.
WordPress 7.1.3 (October 6)
WordPress 7.1.3 fixed 7 security issues and 4 bugs (WordPress.org, Oct 6 2026). The fixes include:
- a way to sneak bad code into the Comments screen in the admin area
- a database bug in the export tool
- a permissions gap that let Author users "sticky" posts
- a leak of comments on private and unpublished posts
WordPress 7.1.4 (October 28)
Just three weeks later, WordPress 7.1.4 fixed 12 more security issues (WordPress.org, Oct 28 2026). Most are "stored XSS" problems. Stored XSS means bad code gets saved into your site and then runs in a visitor's or admin's browser. One fix is for a weakness in the update process itself that "could lead to remote code execution during the upgrade window." Read our WordPress 7.1.4 guide for the full list in plain words.
Plugin fixes: Duplicator and Backuply
Two backup and migration plugins had serious bugs this month:
- Duplicator and Duplicator Pro (CVE-2026-82814): rated 8.8 out of 10, "High." Duplicator up to 1.5.17 and Duplicator Pro up to 4.6.10 are affected (CVE.org, Oct 21 2026).
- Backuply (CVE-2026-93953): rated 8.0, "High." Versions up to 1.5.8 are affected and 1.5.9 fixes it (Patchstack, Oct 15 2026).
Both bugs come into play when you build or restore a backup. See our post on the backup plugin fixes for what to do.
Your to-do list for today
- Take a fresh backup of files and database before you change anything.
- Check your PHP version in WordPress under Tools, Site Health, Info, Server. If it is lower than the safe versions above, ask your host to update it today.
- Update WordPress to 7.1.4 from Dashboard, then Updates.
- Update all plugins and themes, especially Duplicator, Duplicator Pro and Backuply if you use them.
- Delete plugins you don't use. A plugin that is switched off can still be a risk if its files are on the server.
- Check your site after updates: the home page, a contact form, checkout if you sell online.
If your site is old and you are nervous that updates will break it, that is a real worry. It is worth testing on a copy first. Our guide on redesigning without losing Google rankings covers using a staging copy, which works the same way for updates.
What about PHP 8.1 and older?
The PHP team no longer fixes PHP 8.1 or older (PHP.net, Oct 21 2026). WordPress.org also says to avoid PHP versions before 8.2 (WordPress.org, Oct 21 2026). Also note: PHP 8.2 itself stops getting security fixes on December 31, 2026. If you are on 8.2, plan a move to a newer version soon.
When to call for help
Call a developer if:
- your host can't or won't update PHP
- an update breaks your site and you can't roll it back
- you see admin users, pages or files you don't recognise
- you run your own server and aren't sure how to patch it
How Social Buzz can help
We patch and harden PHP and WordPress sites: we check versions, update PHP with your host, test updates on a copy first and clean up old plugins. If you'd like us to check your site after this month's fixes, see our website security service or email info@social-buzz.app.
Questions people ask
What is the most important security update from October 2026 for WordPress sites?
The PHP update. PHP released fixes on October 21, 2026 for two critical holes, and CISA added both to its list of actively exploited flaws on October 26. Safe versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or newer.
Which WordPress version is safe as of October 30, 2026?
WordPress 7.1.4, released October 28, 2026. It fixes a list of security problems, and WordPress.org asks everyone to update right away.
Do I need to update both WordPress and PHP?
Yes. WordPress is the software your site runs, and PHP is the language your server uses to run it. They are updated separately, and this month both had security fixes.
How do I check my PHP version in WordPress?
Go to Tools, then Site Health, then the Info tab, and open the Server section. Your hosting control panel usually shows it too.
Patch, harden and watch your PHP and WordPress site.
Old PHP versions, outdated WordPress plugins and weak logins are common ways websites get broken into. We update and patch your site, close common gaps, and watch it so problems are caught early.
See how we help →