WordPress 7.1.4 updates a certificate list, not the engine
On 28 October WordPress 7.1.4 replaced its bundled root set because of the revoked eMudhra intermediates. This release does not touch the host PHP or the system ca-certificates.
The number 7.1.4 is easy to read as "another WordPress security release, we will do it at the weekend." The reason is specific: eight eMudhra emSign intermediates were revoked because a key from the 30 April 2025 ceremony came out weak. Browsers already reject them. WordPress ships its own root list for the site's own requests: payments, updates, webhooks. While the list is old, the site can trust a peer that Chrome on a laptop already rejects. The story is in the eMudhra note.
Updating WordPress does not update PHP. The October interpreter CVEs stay a separate job, and for most sites on ordinary shared hosting they are the more urgent one. It also does not update the operating system ca-certificates package, or trust inside GitLab Runner or a container. Three lists, three updates. A checkbox in wp-admin closes one.
Related Lexora services
The site is WordPress, and it is unclear what is actually stale
We can separate the core version, the PHP version, and whom the site still trusts over HTTPS.