I presume I will be offline for a short period later today when the updated version (PHP 8.4.27 ) is available – This won’t affect the station.
I use DreamHost:
“Our Operations team has implemented protections against the PHP remote code execution vulnerability across all our hosting platforms, including shared, VPS, DreamPress, and dedicated. These protections are active now, and we have not observed any attack traffic related to this issue to date.”
Critical PHP vulnerabilities expose vast majority of websites to potential compromise
Government agencies urged organizations to take their sites offline until they could be fixed.
WordPress.org
Active Incident
Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place to mitigate the vulnerabilities, but you should still check for updates from your web host and, if necessary, update PHP as soon as possible.
Within WordPress, you can see which version of PHP your site runs under Tools > Site Health > Info > Server. Many web hosts provide this information in your web hosting administration panel too.
These vulnerabilities are not specific to WordPress and affect any server that hosts a PHP application. No WordPress update is required or planned for these issues.
Versions of PHP prior to 8.2 no longer receive security updates from the PHP project.
If your site runs a version prior to this and you manage your own web hosting, you should consider taking your server offline while you prepare to update to a newer version of PHP. This advice is being published by several national cyber security agencies. To quote the UK National Cyber Security Centre:
Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated.
PHP Security Vulnerability: Protections Are In Place
October 21, 2026 9:04AM PDT
MONITORING
We are currently rolling out PHP’s upstream fix fleet-wide. Known attack vectors and confirmed exploit paths across all PHP versions remain closed. Additionally, our Web Application Firewall (WAF) is actively blocking any incoming exploit attempts. We will continue to monitor systems closely as the final upstream fixes finish deploying. The next update will be provided once the fleet-wide deployment is fully complete.
October 21, 2026 6:46AM PDT
MONITORING
Our Operations team has implemented protections against the PHP remote code execution vulnerability across all our hosting platforms, including shared, VPS, DreamPress, and dedicated. These protections are active now, and we have not observed any attack traffic related to this issue to date. Patched PHP versions are being released today. Our Technical Operations team is ready to deploy updated PHP builds as soon as they are available. We’ll share another update once the patched builds are available.