Is your WordPress website on PHP 8.1 or older? What to do now
The PHP project won't fix the October 21, 2026 bugs on 8.1 and older. How backports work, and how to move your WordPress site to PHP 8.3 safely.
If your WordPress website runs on PHP 8.1 or older (PHP is the software WordPress runs on, behind the scenes), the PHP project won't release a fix for the two critical bugs it patched on October 21, 2026. Any protection on that version has to come from the company you pay to keep your website online, through a backport (the fix, copied into an older version by someone else). The lasting answer is moving to PHP 8.3 or newer, after a backup and a test on a copy of the site.
Why does your PHP version matter?
PHP sits on your server (the computer your website lives on), and your host usually looks after it. Your host is the company you pay to keep your website online: GoDaddy, Bluehost, SiteGround and so on.
On October 21, the PHP project shipped fixes for 8.5, 8.4, 8.3 and 8.2 only. Its advisory says "PHP 8.1 and older no longer receive updates from the PHP project" (php.net).
To see your version in WordPress, go to Tools, then Site Health, then the Info tab, and open Server (WordPress.org).
What does your version number mean now?
| Your PHP version | Fix from the PHP project? | What to ask your host |
|---|---|---|
| 8.3, 8.4 or 8.5 | Yes: 8.3.36, 8.4.27 and 8.5.12 | Is the fixed version installed? |
| 8.2 | Yes, in 8.2.35, but 8.2 stops getting fixes on December 31, 2026 | Is 8.2.35 installed, and when can we move to 8.3 or newer? |
| 8.1, 8.0 or 7.4 | No | Is a backported fix installed, and when can we move to 8.3 or newer? |
| 7.3 or older | No | The same questions. WordPress 7.0 and 7.1 don't list these versions as supported |
Sources: php.net, Wordfence, citing the PHP project and the WordPress compatibility table.
Who can fix PHP 8.1 and older?
PHP's advisory says some Linux distributions and long-term support vendors (companies that keep older software patched) provide backported fixes, and tells people to ask their vendor or upgrade to a supported version (php.net).
As of October 21, 2026, some of them had shipped one:
-
cPanel, which makes hosting control panel software, added the fix to its PHP 7.4, 8.0 and 8.1 packages (cPanel changelog).
-
Ubuntu shipped a fixed PHP 8.1 package for Ubuntu 22.04 (Ubuntu).
A backport only helps once your host installs it, and Wordfence notes that "the version number may not change after patching, so confirm with your host" (Wordfence). So "8.1" on your screen doesn't tell you either way. A written answer from your host does.
If your website runs PHP older than 8.2 and you manage your own hosting, WordPress.org says you "should consider taking your server offline while you prepare to update" (WordPress.org). CISA says much the same about PHP 8.1 and earlier (CISA). If your host runs the server for you, start with that written answer.
How many WordPress websites are on PHP 8.1 or older?
About 36% of WordPress websites that report their PHP version run 8.1 or older, and about 1 in 5 run PHP 7 (WordPress.org stats, fetched October 21, 2026, 23:03 UTC).
| PHP version | Share of reporting WordPress websites |
|---|---|
| 8.2 to 8.5 | 63.6% |
| 8.0 and 8.1 | 14.6% |
| 7.x | 19.8% |
| 5.x and older | 2.0% |
That isn't a count of unprotected websites. Hosts can backport the fix, so some of the 36.4% may be covered, and the stats show only the version family (8.3), not the last digits (8.3.36) that show the fix. They also come from WordPress installs that check in with WordPress.org: a large sample, not every site.
How do you move to PHP 8.3 or newer without breaking your website?
WordPress recommends "PHP version 8.3 or greater" (WordPress requirements). Going straight to 8.3 or newer also saves you a second move when 8.2's fixes end on December 31.
WordPress.org's guide to updating PHP is frank about the catch: "Updating your PHP version should not be a problem, but we can't guarantee that it's not." It adds, "we don't know if your themes or plugins will work on newer versions" (WordPress.org, update PHP). Plan it like any job where you can't see inside the wall yet.
-
Take a full backup, files and database (WordPress.org).
-
Check your WordPress version. The compatibility table doesn't list WordPress 6.3 or older as working with PHP 8.3 and newer (compatibility table), so those need a WordPress update first. Update themes and plugins too. That keeps the website working on the new version, but it doesn't fix the PHP bugs.
-
Test on a copy first. Ask your host or web company to make a copy of the website (often called a staging site), move the copy to 8.3 or newer, and click through it.
-
Check what brings in work. On the copy, and again after the switch, send a test request through your service form, open the home page on your phone, and tap the phone number.
-
Agree on the way back. If something breaks, your host can put the previous PHP version back so you can restore the backup (WordPress.org). Treat that as a stopgap while your web person fixes what broke.
Leave the switch itself to your host or web company. Don't change server settings yourself.
What should you send your host?
Subject: PHP version and security fix for [yourdomain.com]
Hello, my website [yourdomain.com] runs PHP [your version]. Please tell me, in writing:
Whether you've installed the fix for CVE-2026-109618 and CVE-2026-109619 on that version, either an official release or a backport.
When you can move my website to PHP 8.3 or newer, and whether you can set up a test copy first.
How we go back if something breaks after the move.
Thank you.
The CVE numbers are the official IDs for these bugs, so your host knows which fix you mean. More messages are on our WordPress advisory page.
Where does The Graphite Lab fit in?
The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. We build websites for trades businesses, and the first draft of a new site is ready for your review within 10 business days of payment. If you'd like to talk it over, book a call.