Security advisory

A security advisory is an official notice from a software maker about a security weakness: what it is, which versions are affected and how to fix it. It tells you what to do, so it is usually more useful to a site owner than the bare record of the problem.

What is a security advisory?

It is more useful for a site owner than the bare CVEA CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. record that sits behind it.

The maker writes it, because the maker knows the code and has the fix. A good advisory answers four questions. What is the problem, in plain terms? Which versions are affected and which are not? Which version fixes it? And is there anything you can do while you wait, such as a setting that reduces the risk?

Advisories come with different labels: security bulletin, security release, security announcement. The name matters less than the content. What you look for is the list of affected and fixed versions, since that is what you compare with your own setup.

Advisory, CVE and score

The three pieces fit together. The CVE gives the flaw a shared ID. The CVSSCVSS is a score from 0 to 10 that shows how serious a security weakness is, so you can see at a glance which problems to deal with first. score says how severe it is. The advisory tells you what to do. A scanner may show only the first two, and then you are left with a number and no instructions. Click through to the advisory.

What it means for a PHP or WordPress site

PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. publishes advisories on php.net with its releases. For WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits., the core team announces security releases, and pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. and themeA WordPress theme is a ready-made package that decides how your WordPress site looks and how its pages are laid out. Change the theme and the design changes. makers announce theirs on their own pages, where the quality varies. Some small plugins publish nothing, and the first sign is a changelog entry that mentions security.

The advisory also tells you what the maker can and cannot say. If it speaks of “affected” versions, that is a statement about the code the maker tested. Older branches that the maker no longer supports are often not mentioned at all, so absence from the list does not mean safe.

A concrete example

On 21 October 2026 php.net published a security advisory with the release of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to the advisory, the releases fix two critical vulnerabilities that can allow unauthenticated remote code executionRemote code execution (RCE) means an attacker can make the computer that hosts your site run their own commands from afar. It is among the most serious flaws., and all PHP users are strongly encouraged to update immediately. It names the installation types at risk: PHP-FPMPHP-FPM is a helper on your hosting that runs your site's PHP code as a separate job and hands the finished page back to the program that answers visitors., ApacheA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files. with mod_phpmod_php is an older way of running PHP, in which PHP is built into Apache, the program that answers visitors, instead of running as a separate helper., php-cgi, FrankenPHP and LiteSpeed. It also covers older versions: PHP 8.1 and older no longer receive updates, and the PHP security team published minimal source patches for 7.4, 8.0 and 8.1. The full status is on our PHP2Shell page.

When to act on an advisory

Act when the advisory covers software you run. Start by finding out your version, using your hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. panel or the free tool to check your PHP version. If your version is listed as affected, install the fixed release as described in the security patchA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem. notes, or ask your host for a date. Take a backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update. first.

If the advisory is about a vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data. in a version that no longer gets fixes, no advisory will help you install a patch. That is the moment to plan a move to a supported version with our help to update PHP in WordPress. Keep every advisory you act on, with the date, so you can show your own timeline later.