What WordPress.com says
WordPress.com blog post 'Your WordPress.com Site is Protected Against the Recent Critical PHP Vulnerabilities' (21 Oct 2026) says Automattic worked with the PHP security team and patches PHP at server level, so sites on WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr are already protected. Customers need not do anything.
Your sites are already protected against the recently disclosed PHP security issues.there's nothing you need to do to keep your site safe from these vulnerabilitiesWordPress.com updates PHP for you when needed.What you need to do
None for sites hosted on WordPress.com. PHP running elsewhere should follow the PHP project's update guidance.
Check which PHP your site runs
WordPress.com does not document this on the pages we read.
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
my.wordpress.com > select site > Settings > Server section > PHP > pick version > Save (some settings need an eligible plan)
Versions offered: 8.3, 8.4.
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
WordPress.com does not offer paid support for old PHP versions. Upgrading is the only route.
Ask WordPress.com directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello WordPress.com support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.