October 21, 2026 — The PHP development team has released emergency updates addressing two critical vulnerabilities that could let an unauthenticated attacker execute code on vulnerable web servers. Identified as CVE-2026-109618 and CVE-2026-109619, the flaws each carry a 9.2 CVSS v4.0 severity score. PHP powers WordPress and numerous other websites, but these are vulnerabilities in the PHP runtime, not bugs in WordPress core.

What The Emergency Patches Fix

According to the official PHP security advisory, the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The issues involve memory handling: one can corrupt internal data during out-of-memory processing, while the other can leave stale request state accessible to a later request. Apache mod_php is considered especially exposed, although PHP-FPM, php-cgi and other web-serving configurations are also affected.

Key Takeaways

• Critical CVEs: 2026-109618 and 2026-109619.
• Patched branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• WordPress.com: Says hosted sites are already protected.
• Self-hosted: Update PHP itself; temporary mitigations are incomplete.

Are WordPress Sites Protected?

The response differs by hosting model. In an October 21 statement, WordPress.com says its managed sites are already protected through infrastructure-level work with the PHP Security Team. That claim covers its hosted platform; it is not a publicly available checksum or build attestation for every site’s PHP binary.

PHP ships emergency patches for critical PHP2Shell flawshttps://t.co/QTZxrNIDgMhttps://t.co/QTZxrNIDgM

— BleepingComputer (@BleepinComputer) October 21, 2026

For self-hosted installations, site owners and administrators must ensure the actual web-serving PHP runtime receives its security update, including container images and hosting-provider packages. Restart affected web and PHP workers as required and verify the patched runtime, rather than relying only on an application’s update notification. PHP 8.1 and earlier have no current upstream releases; distribution or long-term-support backports may be available.

PHP explicitly warns that configuration changes and web-application firewalls can reduce some exposure but do not fully replace patching. Administrators should coordinate with hosting providers and review relevant logs for signs of suspicious activity.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
byu/dyler_turten inPHP

What Website Operators Should Do

For background, BitcoinVersus.Tech’s introductory PHP runtime lesson explains the interpreter and version commands, while its secure logging lesson covers protecting sensitive information during investigations. Neither tutorial substitutes for installing this PHP security update.

PHP CVE Notice
byu/RealKenshino inWordPress

Bottom line: Managed WordPress.com customers have a public assurance of protection from their host. Operators responsible for their own PHP environments should treat the updated releases as urgent and verify that the web-facing runtime—not just WordPress or a security plugin—has been patched.

BitcoinVersus.Tech Editor’s Note: We volunteer daily to ensure the credibility of the information on this platform is Verifiably True. If you would like to support to help further secure the integrity of our research initiatives, please donate using the QR code provided

For best QR-code scanning results, please scan this donation code from a desktop or larger screen. Mobile screens may prevent camera recognition.