Your WordPress.com Site is Protected Against the Recent Critical PHP Vulnerabilities
Two critical PHP vulnerabilities were disclosed on October 21, 2026. WordPress.com sites are already protected, with no action required from site owners.
Today, the PHP project released fixes for two critical vulnerabilities that could allow unauthenticated remote code execution. PHP is the programming language WordPress runs on, which is why it matters to every WordPress site.
If your site is hosted on WordPress.com, there’s nothing you need to do to keep your site safe from these vulnerabilities.
Your sites are already protected against the recently disclosed PHP security issues. Automattic worked closely with the PHP Security team to ensure that all sites hosted on our platform were protected as soon as possible, ensuring all sites hosted with Automattic, including those on WordPress.com, WordPress VIP, WP Cloud, Pressable, and Tumblr, are safe. If you run your own servers, update now.