# Critical PHP security release **URL:** \ **Category:** Questions\ **Created:** [October 21, 2026, 10:28am UTC](https://community.kinsta.com/t/critical-php-security-release/8314 "2026-10-21T10:28:50Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ajb](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/ajb/32/5820_2.png) [@ajb](https://community.kinsta.com/u/ajb)\ **Post date:** [October 21, 2026, 10:28am UTC](https://community.kinsta.com/t/critical-php-security-release/8314/1 "2026-10-21T10:28:51Z")
What’s Kinsta’s expected timeline regarding this security release? > **[Upcoming Critical PHP Security Release - PHP: News Archive - 2026](https://www.php.net/archive/2026.php#2026-10-20-1)** > > The PHP security team would like to give advance notice of an upcoming security release. | PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world. ---
**Author:** ![wnroy](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/wnroy/32/5823_2.png) [@wnroy](https://community.kinsta.com/u/wnroy)\ **Post date:** [October 21, 2026, 11:18am UTC](https://community.kinsta.com/t/critical-php-security-release/8314/2 "2026-10-21T11:18:19Z")
I’m also curious about the current situation report. ---
**Author:** ![Charles\_Wardzinski](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/charles_wardzinski/32/5824_2.png) [@Charles\_Wardzinski](https://community.kinsta.com/u/Charles_Wardzinski)\ **Post date:** [October 21, 2026, 11:21am UTC](https://community.kinsta.com/t/critical-php-security-release/8314/3 "2026-10-21T11:21:01Z")
I am currently 75th in the Kinsta online chat support queue, you might think Kinsta would broadcast an update for all customers considering the volume of enquiries they seem to be handling ---
**Author:** ![Alex\_Hempton-Smith](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/alex_hempton-smith/32/5825_2.png) [@Alex\_Hempton-Smith](https://community.kinsta.com/u/Alex_Hempton-Smith)\ **Post date:** [October 21, 2026, 11:24am UTC](https://community.kinsta.com/t/critical-php-security-release/8314/4 "2026-10-21T11:24:01Z")
116th in line, so please update us when you get a reply! 🙏 ---
**Author:** ![Charles\_Wardzinski](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/charles_wardzinski/32/5824_2.png) [@Charles\_Wardzinski](https://community.kinsta.com/u/Charles_Wardzinski)\ **Post date:** [October 21, 2026, 12:08pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/5 "2026-10-21T12:08:10Z")
Hey there, Thanks for reaching out about this, and for keeping an eye on security! We’re aware of the upcoming PHP security release announced by the PHP security team, and our engineering and security teams are actively monitoring it. Since PHP is managed at the platform level on Kinsta, there’s nothing you need to do on your end. We’ll roll out the fixes across our infrastructure as soon as they’re available and we’ve validated them, and we’ll share updates if anything changes that affects your sites. Here’s where we stand: - We’re rolling out a temporary configuration change across our infrastructure to reduce exposure. It doesn’t affect normal site operations. - Additional Cloudflare protections are already helping block suspicious traffic. - We’re ready to deploy patched PHP versions as soon as they’re released and validated. In the meantime, keeping WordPress core, themes and plugins up to date is always a great step. Let us know if you have any other questions! Kind regards, ---
**Author:** ![Bobby\_Verlaan](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/bobby_verlaan/32/5828_2.png) [@Bobby\_Verlaan](https://community.kinsta.com/u/Bobby_Verlaan)\ **Post date:** [October 21, 2026, 12:15pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/6 "2026-10-21T12:15:32Z")
If there is a link to any public statement from Kinsta on this and how they intend to handle the fix, would be great to post that here in the original post on top 🙂 ---
**Author:** ![ryan-seit](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/ryan-seit/32/5830_2.png) [@ryan-seit](https://community.kinsta.com/u/ryan-seit)\ **Post date:** [October 21, 2026, 12:22pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/7 "2026-10-21T12:22:14Z")
Here’s the latest update I received from our Kinsta Support Engineer: Thanks for reaching out about this, and for keeping an eye on security! We’re aware of the upcoming PHP security release announced by the PHP security team, and our engineering and security teams are actively monitoring it. Since PHP is managed at the platform level on Kinsta, there’s nothing you need to do on your end to apply these updates. We’ve already started rolling out interim mitigations, and we’re prepared to deploy the security fixes across our infrastructure once they’re available and have been validated. We’ll also share updates if anything changes that could affect your sites. Here’s where we stand: - We’re rolling out a temporary configuration change across our infrastructure to reduce exposure. It doesn’t affect normal site operations. - Additional Cloudflare protections are already helping block suspicious traffic. - We’re ready to deploy patched PHP versions as soon as they’re released and validated. ---
**Author:** ![joeydi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/joeydi/32/5831_2.png) [@joeydi](https://community.kinsta.com/u/joeydi)\ **Post date:** [October 21, 2026, 12:24pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/8 "2026-10-21T12:24:28Z")
Thanks for the update @ryan-seit Crazy that they have not made any official announcement yet. ---
**Author:** ![wnroy](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/wnroy/32/5823_2.png) [@wnroy](https://community.kinsta.com/u/wnroy)\ **Post date:** [October 21, 2026, 1:42pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/9 "2026-10-21T13:42:55Z")
The update is live here are the details [https://www.php.net/](https://www.php.net/) ---
**Author:** ![Luuk-Scherp](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/luuk-scherp/32/5834_2.png) [@Luuk-Scherp](https://community.kinsta.com/u/Luuk-Scherp)\ **Post date:** [October 21, 2026, 2:07pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/10 "2026-10-21T14:07:57Z")
I think its truly poor that Kinsta does not have a status page for this issue… Nearly all websites in The Netherlands are down, it’s a massive thing here. What do I communicate with my clients, knowing Kinsta doesn’t seem to care not even half as much as they do? ---
**Author:** ![VladimirM](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/vladimirm/32/2786_2.png) [@VladimirM](https://community.kinsta.com/u/VladimirM)\ **Post date:** [October 21, 2026, 2:08pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/11 "2026-10-21T14:08:11Z")
Hello everyone 👋 We were providing updates via chat, as you noted above. What @ryan-seit shared is what we had as public information. The patch is still not applied, but our engineering team is working on that. Due to security concerns, we aren’t sharing any additional details but we are aware of the issue and working on it. Kind regards, Vladimir M | Support Lead EMEA ---
**Author:** ![wnroy](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/wnroy/32/5823_2.png) [@wnroy](https://community.kinsta.com/u/wnroy)\ **Post date:** [October 21, 2026, 2:56pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/12 "2026-10-21T14:56:49Z")
Could you please release a public message when the update has been rolled out? ---
**Author:** ![joshdprts](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/joshdprts/32/5835_2.png) [@joshdprts](https://community.kinsta.com/u/joshdprts)\ **Post date:** [October 21, 2026, 3:02pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/13 "2026-10-21T15:02:49Z")
Would highly appreciate that, even just an ongoing update that it’s still being worked on. Getting a bit antsy refreshing phpinfo pages! Security angle of not publishing whether the sites are vulnerable or not is a little moot when it’s already publicly acknowledged so surely transparency is the best route here? ---
**Author:** ![TSP](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/tsp/32/5837_2.png) [@TSP](https://community.kinsta.com/u/TSP)\ **Post date:** [October 21, 2026, 3:13pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/14 "2026-10-21T15:13:33Z")
You should have posted official announcements on your news/blog section, your status page, and security banners when logging in to the admin panel. That you have not done so is crazy to me. For example, you should look at the announcement from Laravel for inspiration: [https://laravel.com/blog/php-critical-vulnerability-response-updates](https://laravel.com/blog/php-critical-vulnerability-response-updates) ---
**Author:** ![joeydi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/joeydi/32/5831_2.png) [@joeydi](https://community.kinsta.com/u/joeydi)\ **Post date:** [October 21, 2026, 3:27pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/15 "2026-10-21T15:27:27Z")
Why has there been no public communication about this? Nothing in the dashboard, nothing on the blog, nothing on the status page. Really disappointing. ---
**Author:** ![halshak](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/halshak/32/2751_2.png) [@halshak](https://community.kinsta.com/u/halshak)\ **Post date:** [October 21, 2026, 3:34pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/16 "2026-10-21T15:34:35Z")
It’s great how we all get to continue serving our sites on unpatched versions of PHP. Please, take your time. 🙄 ---
**Author:** ![Northplace](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/northplace/32/5839_2.png) [@Northplace](https://community.kinsta.com/u/Northplace)\ **Post date:** [October 21, 2026, 3:37pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/17 "2026-10-21T15:37:40Z")
I’m really surprised that a company like Kinsta fails to provide an updated status on what could potentially be largest vulnerability ever… ---
**Author:** ![Kris](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/kris/32/5840_2.png) [@Kris](https://community.kinsta.com/u/Kris)\ **Post date:** [October 21, 2026, 3:45pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/18 "2026-10-21T15:45:00Z")
@VladimirM I assume you guys will update this post once changes are applied? Get its a stressful day for you folks, I just want to make sure I am on top of public progress and statuses. ---
**Author:** ![joshdprts](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/joshdprts/32/5835_2.png) [@joshdprts](https://community.kinsta.com/u/joshdprts)\ **Post date:** [October 21, 2026, 4:19pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/19 "2026-10-21T16:19:05Z")
Upgrades now appear to be propagating, some but not all of our clients are showing patched versions. Thanks Kinsta team, I’m breathing a seriously large sigh of relief right now. ---
**Author:** ![nielsinthecloud](https://sea2.discourse-cdn.com/flex020/user_avatar/community.kinsta.com/nielsinthecloud/32/5842_2.png) [@nielsinthecloud](https://community.kinsta.com/u/nielsinthecloud)\ **Post date:** [October 21, 2026, 4:33pm UTC](https://community.kinsta.com/t/critical-php-security-release/8314/20 "2026-10-21T16:33:02Z")
**Update: PHP 8.5 patch is live on Kinsta, other versions still in progress** For anyone still waiting: I confirmed with Kinsta support via chat that the patched release is currently being rolled out for **PHP 8.5 only**. Patches for the other PHP versions are still being worked on. 8.5.12 contains the patch: > **[PHP: News Archive - 2026](https://www.php.net/archive/2026.php)** > > PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world. **Quickest way to get patched right now** 1. In MyKinsta, switch the environment to PHP 8.5 (check plugin and theme compatibility first, ideally on staging). 2. Connect via SSH and run `php -v`. 3. You should see **PHP 8.5.12** , built Oct 21 2026. On my site it switched from 8.2.30 to 8.5.12 within a few checks. Note: the [php.net](http://php.net) archive only lists the minor version (8.5), not the full patch number, so `php -v` is the reliable way to verify. **Don’t suspend your environments** If you suspended sites to take them offline, they won’t receive the patch. Suspending stops the whole container, not just the web side, so Kinsta can’t apply the update. Kinsta support recommends this instead if you want your sites offline in the meantime: - Kinsta already added new firewall rules this morning, so taking sites offline may not be necessary. - If you still want to, add a Bot protection exception, set it to **Path** , **Block** , and use `/`. - This blocks all traffic to the site while still allowing Kinsta to push the update. The rule can take up to 5 minutes to propagate. Hope this helps others in the queue. [Next page](https://community.kinsta.com/t/critical-php-security-release/8314.md?page=2)