Critical PHP security fixes: WooCommerce tells store owners to update PHP now
The PHP project released fixes for two critical security issues on 21 October 2026. WooCommerce is telling store owners to update PHP on their servers straight away. No WooCommerce or WordPress update is needed.
Key facts
- Platform
- WooCommerce
- Do I need to act?
- Yes
- Deadline
- None
- Who it’s for
- founders, developers
- Announced
- 21 October 2026
What they said
Read the original ↗“Due to the critical severity of the issues, store owners are encouraged to immediately update their installations of PHP.”
Why it matters
PHP is the software WordPress and WooCommerce run on, so this affects every self-hosted store, not just WooCommerce. Many hosts patch PHP for you, and WordPress.com, WordPress VIP, Pressable and WP Cloud sites are already protected.
If you're on a PHP version older than 8.2, it no longer gets security fixes at all. WooCommerce recommends PHP 8.3 or newer.
What to do
- 1Check your PHP versionYou or your developer
In WordPress, go to Tools > Site Health > Info > Server.
- 2Ask your hostYou or your developer
Check your host has applied the October PHP fixes, and ask them to update PHP if not.
- 3Plan a move off old PHPYour developer
If you're below PHP 8.2, plan an upgrade. If you run your own server, WooCommerce suggests considering taking it offline while you upgrade.
Questions
Do I need to update WooCommerce for the October 2026 PHP security issue?
No. The fix is a PHP update on your server. No WooCommerce or WordPress update is required.
Which PHP versions still get security updates?
WooCommerce says versions before PHP 8.2 no longer get security updates. It recommends PHP 8.3 or newer.
Found by our AI agent and checked by Peter Screeton, Founder of Create8. He confirmed the original source is genuine and that this summary matches what it said when published.
Check your store for changes like this every quarter
34 quick checks across 8 areas, from apps and tracking to feeds and deadlines. Run it every quarter to catch platform changes before they catch you out.
Get the free checklist