WordPress PHP security update: a checklist for agencies

Yes, check every site. The October 2026 PHP security release fixes two critical flaws in PHP itself, so this WordPress PHP security update comes from your host or server, not from WordPress. WordPress.org says no WordPress update is required or planned. Confirm each site’s PHP version and whether your host has patched it.

If you are already opening client sites for this job, you can add a second, separate job in the same visit: cookie consent and a privacy policy with Savira. This guide is for agencies that manage WordPress sites for clients, especially health practices. Part 1 covers the PHP update. Part 2 covers the optional Savira step. Savira does not fix, patch or protect against the PHP issue.

What has been confirmed about the PHP security release?

Here is what WordPress.org confirmed on 21 October 2026:

• The PHP project has released fixes for two critical vulnerabilities in PHP itself.

• They are not specific to WordPress. Any server running a PHP application is affected.

• No WordPress update is required or planned.

• Many hosts are already updating PHP and adding firewall rules, but site owners are still asked to check with their host and update if needed.

• PHP versions before 8.2 no longer get security updates. If you manage your own hosting on one of those, WordPress.org says to consider taking the server offline while you prepare to upgrade.

The WordPress.org post does not list CVE numbers or patched version numbers. Get those from the PHP project’s announcement, which the post links to.

How do you do the WordPress PHP security update?

Follow your host’s advice and your own change process first. This is the outline.

1. Check each site’s PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server. Most hosting panels show it too.

2. Ask your host what it has done. Many hosts are patching PHP and adding firewall rules themselves. Confirm whether each site is covered or whether you need to act.

3. Sort sites into three groups. Already patched by the host, on a supported PHP version that needs updating, and on PHP older than 8.2 (no longer supported, needs a full upgrade).

4. Back up before you change anything. Files and database, stored off the server.

5. Plan downtime only where it is needed. Most hosts will patch PHP without taking sites down. Downtime mainly applies to self-managed servers on PHP older than 8.2.

6. Apply the update. Use your host’s process, and check the version you land on against the PHP project’s announcement.

7. Test the site. Front end, forms, bookings, logins and checkout. Older themes and plugins can break on newer PHP, and WordPress.org keeps a PHP compatibility reference.

8. Record what you did. PHP version before and after, the date, and who did it. This goes in your client handover.

   

Should you add cookie consent while you are in the site?

It is optional, and it is a separate job. Once the site is updated and tested, adding Savira uses the same login and the same maintenance window. Savira is free to get started on the Starter plan.

It is worth a look for health clients. Health service providers are generally covered by the Privacy Act 1988 (Cth) whatever their size, and many practice sites load analytics or ad tags with no consent banner, or have an old or missing privacy policy. Our health industry page explains more. Savira’s WordPress plugin adds a consent banner, keeps consent records and helps generate a privacy policy.

How do you add Savira to a WordPress site?

Setup takes about 10 minutes per site.

1. Check where the site stands (optional). Run the free website privacy scanner.

2. Install the Savira WordPress plugin. Do this after the PHP update is tested, not before.

3. Create or connect your Savira account.

4. Set up the consent banner.

5. Generate or update the privacy policy. Have the client review it before it goes live. Our guide to privacy policy requirements in Australia covers what it should include.

6. Check it works. Load the site in a private window, confirm the banner shows and that trackers wait for consent.

What should you give the client at handover?

Keep the two jobs separate in what you tell the client, so nobody thinks the consent banner is part of the security fix.

• PHP version before and after, and the date it was updated

• Backup taken, and where it is stored

• Site tested after the update, and anything that needed fixing

• If added: Savira installed, banner live, privacy policy reviewed by the client

• Next review date for PHP and the privacy policy

Here is a client note you can adapt:

We have updated your website’s PHP to address the security release announced on 21 October. Your site has been backed up and tested. While we were in there, we also added a cookie consent banner and set up your privacy policy using Savira. That is a separate improvement, not part of the security fix, and Savira is free to get started on its Starter plan.

If you only did the PHP update, send the first three sentences and stop there.

Source: Critical PHP Security Release, WordPress.org News, 21 October 2026.

This is general information, not legal advice. Every business handles information a bit differently, so if you’re not sure how this applies to yours, it’s worth checking with a lawyer or privacy adviser.