Skip to content
Emir Hoca.

An October 2026 check for WordPress sites: PHP patches and 7.1.4

October brought critical PHP fixes and the WordPress 7.1.4 security release. One lives on the server, one in WordPress, and both need checking.

2 min read

In the last two weeks of October, two separate security updates landed that affect WordPress sites. On 21 October 2026 the PHP project announced two critical vulnerabilities, and on 28 October WordPress 7.1.4 shipped with several security fixes. One sits on the server, the other in WordPress itself. Keeping plugins up to date covers neither, so each needs its own check.

What happened with PHP?

The PHP project announced two critical vulnerabilities that could allow remote code execution without authentication (PHP, 21 October 2026). The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to the PHP team, PHP installations that serve web requests are affected, and updating is the only complete fix.

The same day, WordPress.org explained that these vulnerabilities are not specific to WordPress and that no separate WordPress release is planned for them (WordPress.org, 21 October 2026). In short, updating WordPress doesn't fix this; PHP on the server has to be updated. On shared or managed hosting, that is usually the host's job.

One caveat. Some Linux distributions and managed hosts backport security patches under different package version numbers. If the version in your panel differs from the ones above, that alone doesn't mean your site is exposed. The safest route is written confirmation from your host.

What's in WordPress 7.1.4?

WordPress 7.1.4 was released on 28 October 2026 with a recommendation to update immediately (WordPress.org, 28 October 2026). The fixes include a weakness in the update screen that could lead to remote code execution, plus several stored XSS issues. Stored XSS means malicious code saved on the site runs in the browser of other users who open that page.

If automatic core updates are on, your site has probably updated itself. Still, check the version number in the Dashboard instead of assuming it.

What to do this week

  1. Note your PHP version under Tools > Site Health > Info > Server in WordPress.
  2. Ask your host to confirm that the two October PHP vulnerabilities are patched on your server.
  3. After taking a backup and testing on staging, update WordPress core to 7.1.4 or a newer secure version.
  4. After updating, test admin login, forms, payments, email sending and scheduled tasks.
  5. Review WAF logs, admin accounts and recent file changes for anything suspicious.

The last step is about finding out whether anything happened before the patches arrived. If you see an admin account you don't recognise or a file change you didn't make, updating isn't enough and the site needs a closer look.

What to ask your host

Asking "Is PHP up to date?" usually gets a "yes" that tells you nothing. Ask something more precise: "Are the two critical PHP vulnerabilities announced on 21 October 2026 patched on the server my site runs on? With which PHP version or package version?" On managed hosting, the provider has probably announced this already; ask for the link to that notice and keep it on file.

If you run on your own VPS or on a server a developer set up, that person is the one to ask. In that case, check together after the PHP update that the site loads and that forms and payments still work.

If you'd like technical support while you talk to your host about this, you can reach me here.

Sources