Your WordPress.com Site is Protected Against the Recent Critical PHP Vulnerabilities

By Ian Stewart on October 21, 2026

Today, the PHP project released fixes for two critical vulnerabilities that could allow unauthenticated remote code execution. PHP is the programming language WordPress runs on, which is why it matters to every WordPress site.

If your site is hosted on WordPress.com, there’s nothing you need to do to keep your site safe from these vulnerabilities.

Your sites are already protected against the recently disclosed PHP security issues. Automattic worked closely with the PHP Security team to ensure that all sites hosted on our platform were protected as soon as possible, ensuring all sites hosted with Automattic, including those on WordPress.com, WordPress VIP, WP Cloud, Pressable, and Tumblr, are safe. If you run your own servers, update now.

Why you didn’t have to lift a finger

On WordPress.com, PHP is installed, maintained, and patched by us at the infrastructure level, not by you. Our security team prepared for this release ahead of time, so every site on the platform is covered.

That’s the difference between doing it yourself and managed hosting (like what you get on WordPress.com). At many hosts, the site owner is responsible for security: updating software, installing a security plugin, watching for threats. On WordPress.com, we handle it for you.

How WordPress.com protects your site every day

This week’s news isn’t one-off work for our team; we ensure that these protections are on all the time for WordPress.com sites:

Automatic updates: We keep your WordPress version up to date automatically.
Encryption by default: Every WordPress.com site, including custom domains, is served over SSL, and insecure requests are redirected to HTTPS.
Daily malware scans: Jetpack Scan checks every WordPress.com site daily for dangerous plugins, themes, and malware. Our security team resolves what it finds, and we email you if we have to remove something.
A firewall in front of your site: Our web application firewall examines incoming traffic and blocks suspicious IP addresses, malicious bots, and unusual activity.
Monitoring: We watch for suspicious activity, including brute-force login attempts and DDoS attacks, and alert you if your site goes down.
Backups: We back up site data regularly, and sites on higher-level plans can access daily backups from the dashboard.

Your part

Of course, security works both ways, and there are still some things that you can do to ensure your site stays secure: use a strong password, turn on two-step authentication, keep your account email current, and review plugins and user roles regularly.

You don’t need to install a separate security plugin, and some can interfere with the protections you already get by using WordPress.com.

No service can promise perfect security, and we won’t pretend otherwise. On WordPress.com, security is our job to solve, not yours.