Why updating WordPress or plugins won't fix the October PHP bugs
The October 21 bugs are under WordPress, so plugin and theme updates can't reach them. What fixes it, who installs it, and what a firewall does.
Updating WordPress, plugins, or themes won't fix the two critical bugs announced on October 21, 2026, because the bugs are in PHP, the software WordPress runs on behind the scenes. The fix is a new version of PHP installed on your server, the computer your website lives on, and that's usually your hosting company's job (the company you pay to keep your website online). A firewall can buy time while that happens, but it isn't the fix.
Where does PHP sit under your WordPress website?
Think of your website as layers stacked on each other. Each layer gets its own updates, and a different person usually installs them.
| Layer | What it is | Who usually updates it |
|---|---|---|
| Plugins and theme | Add-ons that change what your website does and how it looks | You or your web person, from the WordPress dashboard |
| WordPress | The software you log in to and edit pages with | You, your web person, or WordPress's automatic updates |
| PHP | The software that runs WordPress behind the scenes | Your hosting company, or whoever manages the server |
| The server | The computer your website lives on | Your hosting company, or whoever rents it |
The October 21 bugs are in the PHP layer. Updates to the layers above it don't reach it. WordPress.org says these vulnerabilities "are not specific to WordPress and affect any server that hosts a PHP application" (WordPress.org).
What do WordPress.org and security companies say?
WordPress.org's notice on October 21 says: "No WordPress update is required or planned for these issues" (WordPress.org). Wordfence, which makes a WordPress security plugin, says WordPress automatic updates "will not fix them. PHP has to be updated on the server" (Wordfence). Patchstack and Sucuri, two more WordPress security companies, also say the fix is a PHP update (Patchstack, Sucuri).
Why doesn't a security plugin fix it?
A security plugin is part of WordPress, and WordPress only starts once PHP is running. PHP's advisory says that on the setup it considers riskiest, there's a demonstrated exploit where a request "can trigger the attack before any application code runs" (php.net). WordPress and every plugin count as application code, so on that setup the attack can start before a plugin has loaded.
The same goes for "fix" plugins and code snippets passed around online. Patchstack advises avoiding both (Patchstack). PHP also lists some stopgap server settings for people who can't update yet, and says they "do not make an installation safe" (php.net). Those are for your hosting company or developer to weigh, not something to change yourself.
What does fix it?
A version of PHP with the fix. PHP's advisory is blunt about it: "There are no complete mitigations, updating is the only safe choice" (php.net). The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your website shows one of those, or a higher number in the same series, under Tools, Site Health, Info, Server, the official fix is in. Our guide to checking your PHP version walks through every other result.
Older versions can be covered too, but not by the PHP project, which no longer fixes 8.1 and older. Some hosting companies get the fix copied onto older versions by their software suppliers. As of October 21, 2026, cPanel, the control panel many hosting companies use, had done that for its PHP 7.4, 8.0, and 8.1 (cPanel).
Who installs the fix?
If you pay a hosting company, it updates PHP. If you or a developer rent a server of your own, the update is yours or your developer's (Wordfence).
As of October 21, 2026, some hosting companies told customers they had nothing to do. Pressable said "Every PHP version available on Pressable is protected" (Pressable), and WordPress VIP said "No action is required on your part" (WordPress VIP). Others were still rolling the fix out. Notices change through the day, so re-check with your hosting company and get its answer in writing. Here's the message to send your hosting company.
What does a firewall do, and what doesn't it do?
A web application firewall is a filter that sits in front of your website and blocks requests that match known attacks. Cloudflare switched on rules for these bugs by default at 3:02 am UTC on October 21 for customers using its firewall (Cloudflare). That helps. CISA, the federal cybersecurity agency, puts it this way: "A web application firewall may provide some protection until systems are updated or patched" (CISA).
A firewall can only block what its rules recognize. Cloudflare says it has seen attack traffic aimed at these bugs, with attackers "mutating the attack payload to try to bypass our protections" (Cloudflare). CISA, for its part, said it had not observed exploitation as of its October 21 alert (CISA). A firewall also only screens traffic that passes through it, and Sucuri advises restricting access to the server so attackers can't go around it (Sucuri). Cloudflare itself tells customers to "patch their PHP repos even with WAF protections" in place (Cloudflare).
So keep the firewall on, and still get the PHP update.
Should you keep WordPress and plugins updated anyway?
Yes, for their own sake. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, and 91% of them were in plugins (Patchstack). Deleting plugins and themes you don't use helps too. That work guards against a different set of problems. It just doesn't touch these two bugs. For the full picture of the October 21 advisory, see our WordPress advisory page.
Who is The Graphite Lab?
The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. If you're weighing a new site, the first draft is ready for your review within 10 business days of payment.
Want to see this on your board?
Book a 30-minute call and we’ll walk through it live.