Despite this coordination, WP-Engine (who's major business is hosting WordPress sites) is still on PHP 8.4.26 a full 2.5 hours after the patch is publicly available.
wpe-user@MYENVIRONMENT.ssh.wpengine.net:~$ php -v
PHP 8.4.26 (cli) (built: Sep 23 2026 06:24:29) (NTS)
Copyright (c) The PHP Group
Built by Perforce Zend (www.zend.com)
Zend Engine v4.4.26, Copyright (c) Zend Technologies
with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies
When I’ve worked at small places, a security patch is bumping some versions and restating some servers.
I worked at a massive Rails shop for a decade and a big security bump meant mobilizing a team, coordinating updating dozens or hundreds of apps, all while maintaining platform stability and staying within SLAs. It’s a nightmare.