A security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem. The weakness is public, the maker has changed the code, and installing the update is what makes your site safe against that particular flaw.
What is a security patch?
A security patch is the fix that goes with a CVEA CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. or a security advisoryA security advisory is an official notice from a software maker about a security weakness: what it is, which versions are affected and how to fix it., and it adds no new features.
Software makers deliver security patches in a few ways. In PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it., a security fix ships as a new patch version, such as 8.4.27 on the 8.4 branch, that changes as little as possible besides the fix. WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. core, plugins and themes follow the same pattern through their update screens.
A patch is not the same as a backportA backport takes a fix made for a newer version of software and applies it to an older version, so the old one gets the fix without a full upgrade.. A backport takes a fix made for a newer version and applies it to an older branch that the maker no longer actively develops.
Why patches arrive in a rhythm
PHP branches move through phases. According to php.net, a branch first gets active supportActive support is the phase in which a PHP version is fully looked after: both ordinary bugs and security problems get fixed, with regular updates., then only security fixes, and then reaches end of lifeEnd of life (EOL) means the makers have stopped looking after a version of software. It still works, but it no longer gets updates, not even security fixes.. A branch in the security phase still receives patches. Once it is past that, no official patch will come, however serious the flaw. The dates for the branches that matter now are on php.net/supported-versions.php, which is the source we use.
What it means for a PHP or WordPress site
For a site owner, installing patches is the main way to stay safe, and it needs a process more than it needs skill. The process is: know which versions you run, watch for advisories from their makers, take a backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update., update a copy first when it matters, then update live and check the pages that earn money.
Automatic updates help for small, trusted components. For the PHP runtime and for plugins that carry checkout or forms, a planned update with a test is safer than an unattended one. Patches reduce the chance that something is used, but they do not remove every risk, so keep the attack surfaceThe attack surface is the total of all places where an attacker could try to get in, such as logins, forms, plugins and the code on your server. as small as you can by removing what you do not use.
A concrete example
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which php.net says fix two critical vulnerabilities. To patch, you move to the fixed version of your branch: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. On PHP 8.1 or older, the PHP project no longer ships updates, although the PHP security team published minimal source patches for 7.4, 8.0 and 8.1, and some distributions provide their own patched packages. Ask your host or vendor which applies to you. The current status is on our PHP2Shell page.
When to act
Act when the maker says to update, and move faster when the word is “immediately”. check your PHP version first with the free tool or your hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. panel. If you want the work done with a stagingA staging environment is a private copy of your website where you try updates first, so any mistakes happen there and not on the live site. test and a way back, ask us to update PHP in WordPress. If the site is down or something looks wrong after an incident, start with our help to fix your WordPress website.
Frequently asked questions
What is the difference between a security patch and a regular update?
A security patch only closes a known vulnerability. A regular update may add features, change behavior or fix other bugs. Security releases are usually smaller, which makes them lower risk to install.
Can a security patch break my site?
It can, although security-only changes are kept small on purpose. That is why you take a backup first and test on a copy when you can. Leaving a known flaw open is usually the larger risk.
What if my PHP version no longer gets patches?
Then you need to move to a supported version. Some distributions and long-term support vendors provide their own fixed packages, which is worth asking your host about.
How quickly should I install a security patch?
As quickly as you can do it safely. When the maker says to update immediately, plan it within days. For lower-severity fixes, the next maintenance window is usually fine.