Status as of October 26, 2026: WordPress.com reports patching PHP on its managed plans (confirmed in two of its own documents).
The short answer
WordPress.com reports PHP is patched by WordPress.com at the infrastructure level: All sites on WordPress.com (also WordPress VIP, WP Cloud, Pressable). We found two of the host’s own documents saying so. A host’s statement covers its managed platform, not a server you run yourself (source: GoDaddy). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).
Fix status on WordPress.com
| What | Fixed build or status | Advisory | Confirmed? | Sources |
|---|---|---|---|---|
| All sites on WordPress.com (also WordPress VIP, WP Cloud, Pressable) | Host reports PHP is patched by WordPress.com at the infrastructure level. WordPress.com says there’s nothing customers need to do. | WordPress.com blog and Automattic post, Oct 21, 2026 | Yes: two primary sources. Can’t tell from version | WordPress.com: PHP2Shell vulnerabilities, Automattic: Your sites are protected against the… |
How to check on WordPress.com (read-only)
On WordPress.com you can’t inspect the server; the platform statement is the evidence. Keep a dated copy for your records.
If someone else runs your server, ask them in writing: the questions and a copy-ready email. If it’s your own VPS or server, nobody patches PHP for you; check it with the steps for your Linux distribution in the status table. (source (source: GoDaddy))
CVE-2026-115560
On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).
On WordPress.com: Neither WordPress.com post mentions CVE-2026-115560.
Notes for WordPress.com
- Automattic’s post adds that updating WordPress alone won’t protect a site you run on your own server. The flaw is in PHP (source: php.net security advisory, October 21, 2026; WordPress.org version statistics).
- Your host may have patched PHP: WordPress.com said it did. Ask for written confirmation if you need it for your records (source: GoDaddy).
Sources (checked October 26, 2026)
- WordPress.com (Automattic): PHP2Shell vulnerabilities. Page date: Oct 21, 2026. States: All sites hosted on the platform were protected; PHP is maintained and patched by WordPress.com at the infrastructure level; nothing customers need to do.
- Automattic: Your sites are protected against the PHP2Shell vulnerabilities. Page date: Oct 21, 2026. States: WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr already protected; updating WordPress alone will not protect self-run sites.
Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.
Related
WP Engine · GoDaddy · All platforms · How to prove your server is patched · What to ask your host or developer
Want it checked for you?
- Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
- Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.