Find the risk
We read the PHP that answers the web. Status is Patched, At risk, or Unknown. Unknown often means the host installed a fix, but PHP still needs a restart.
Black October
Is your PHP fixed yet?
PHP itself had two critical holes in October 2026. They can run before WordPress. Official fixed builds start at PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older have no official fix. Your host has to install the update and restart PHP.
Black October
Is your PHP fixed yet?
October 2026 opened two critical holes in PHP (CVE-2026-109618 and CVE-2026-109619). Most sites still need the host update. Bedrock finds the risk, alerts the same day, hardens what it can, and watches while the host patches.
Alert the same day
Watch can email, Slack, or ping a webhook when PHP is at risk. Quiet hours do not mute this class. The note names the CVEs and the minimum official fix for that branch.
Harden what we can
A config switch and optional Cloudflare edge rules lower the chance of a hit. They do not fully fix the bug. Only a patched PHP plus a worker restart does.
Source: CISA (updated 2026-10-23) and PHP.net archive 2026-10-21. Bedrock does not patch PHP itself.
what to say
What to ask your host
Copy this. You do not need to change DNS.
Please install the October 2026 PHP security update (CVE-2026-109618 and CVE-2026-109619). Then restart PHP-FPM or Apache so the new build is the one that answers the web. Official floors are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If this site is on PHP 8.1 or older, move it to a supported branch.
Source: CISA (updated 2026-10-23) and PHP.net archive 2026-10-21. Bedrock does not patch PHP itself.
Ready
Protect this WordPress site.
Install, connect once, leave defaults on. Setup never requires a DNS change.