WORDPRESS PHP SECURITY UPDATE CHECKLIST
Guidance checked: 23 October 2026
Turing Websites: https://turingwebsites.com
Guide: https://turingwebsites.com/blog/wordpress-php-security-update-help
Hands-on help: https://turingwebsites.com/services/php-security-updates

Use this editable record with your host or developer. Keep passwords, keys,
raw logs and customer records in a secure support channel.
This checklist records actions and evidence; it does not certify that a site
has never been compromised.

1. RECORD THE SITE AND HOST
Website URL:
Hosting provider and plan:
AWS service/blueprint, if applicable:
Person responsible for the PHP runtime:
Current symptoms and customer impact:
Business deadline:

2. CONFIRM THE SERVING PHP RUNTIME
WordPress: Tools > Site Health > Info > Server.
Reported PHP version and server API:
Host's package/runtime confirmation for CVE-2026-109618:
Host's package/runtime confirmation for CVE-2026-109619:
Restart or deployment completed (time, timezone and operator):

Fixed upstream releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or a later
maintained release on the same branch. Vendor backports can display an
older-looking version. Check the vendor's evidence for both CVEs and the
runtime serving this website; command-line PHP can be a different copy.
PHP 8.1 and older have ended routine upstream security support.

Managed hosting notice checked and date:
Automattic says WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr
are already protected. Follow the provider's current guidance.

3. PRESERVE THE SITE AND CHECK COMPATIBILITY
[ ] Recoverable database, uploads, code and configuration copies preserved.
[ ] Active theme, child theme, plugins and custom code identified.
[ ] Target PHP branch and required extensions checked.
[ ] Staging isolated from live email, payments and production webhooks.
[ ] Compatibility fixes checked in the intended environment.
[ ] New bookings/orders during the change have a preservation plan.

4. RECORD CUSTOMER-ACTION RESULTS
Use permitted test records and the payment provider's supported test mode.
For each check, record environment, URL, time, expected and observed result.

Contact form: saved record and notification:
Booking: availability, appointment record and confirmation:
WooCommerce: payment result, order status, tax/delivery and receipt:
Account/membership: sign-in and relevant action:
Connected workflow: destination record, fields and duplicates:
Unresolved issue, owner and next action:

5. KEEP THE UPDATE EVIDENCE
Runtime and package evidence after the change:
Checks completed by and date:
Recovery points and any record reconciliation:
Outstanding maintenance or move from an unsupported PHP branch:

Temporary WAF or configuration measures are incomplete. Follow the current
PHP advisory and the hosting provider's instructions. Suspected compromise
needs the host's security team or an appropriate incident-response specialist;
preserve evidence through their secure support channel.

PRIMARY SOURCES
PHP advisory: https://www.php.net/archive/2026.php#2026-10-21-5
WordPress: https://wordpress.org/news/2026/10/critical-php-security-release/
Automattic: https://automattic.com/2026/10/21/php2shell/
UK NCSC: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php