Two New Critical PHP Vulnerabilities Discovered: How to Update and Protect Your WordPress Website Guide
PHP has released emergency security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution. If your website uses an affected PHP runtime, updating WordPress, themes, or plugins alone will not install the required server-level fixes.
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Install the fixed release for your supported branch, or a newer release containing the fixes. Hosting providers using backported security patches should confirm the exact fixed package.
Technical information checked: October 22, 2026. Primary source: PHP’s official security advisory . Recheck your provider’s advisory before making changes.
What are the two critical PHP vulnerabilities?
The flaws affect PHP itself—the software that processes server-side application code. They are not vulnerabilities in a particular WordPress theme or plugin. Remote code execution means an attacker may be able to run malicious code on an affected server without first signing in.
CVE-2026-109618: Out-of-memory corruption
PHP’s handling of an out-of-memory condition can interrupt request setup while internal data is only partially initialised. During cleanup, PHP may treat that invalid data as valid, creating a path to remote code execution.
CVE-2026-109619: Stale global state
Internal request state can remain after its underlying memory has been freed. A later request handled by the same worker may access that stale state before normal initialisation resets it.
Source: PHP security advisory and vulnerability descriptions . PHP’s advance notice rated both issues CVSS v4.0 9.2.
Which PHP versions contain the security fixes?
Check the full version number. Being on “PHP 8” or “PHP 8.3” does not establish that your installation is patched. The point release—or your vendor’s documented backport—is what matters for these vulnerabilities.
| PHP branch | First fixed upstream release | Required action |
|---|---|---|
| PHP 8.5 | 8.5.12 | Update earlier releases or confirm a vendor fix. |
| PHP 8.4 | 8.4.27 | Update earlier releases or confirm a vendor fix. |
| PHP 8.3 | 8.3.36 | Update earlier releases or confirm a vendor fix. |
| PHP 8.2 | 8.2.35 | Patch now and plan migration before upstream security support ends on December 31, 2026. |
| PHP 8.1 and older | No regular upstream-supported branch | Confirm any vendor-provided protection and arrange migration to a supported PHP version. |
Sources: PHP release announcements and PHP support lifecycle .
What if my host uses an older-looking package number?
Some operating-system distributions and long-term support vendors backport security fixes to their maintained packages. Ask for the vendor advisory, exact installed package release, and confirmation that both CVEs are fixed. Do not assume either “vulnerable” or “protected” from a short version label alone.
PHP also supplied minimal source backports for PHP 7.4, 8.0, and 8.1 for this emergency. These do not restore normal upstream support for those branches. See PHP’s guidance for older installations.
Why WordPress updates do not fix PHP
WordPress and PHP are separate software layers. WordPress automatic updates do not, by themselves, update the server’s PHP runtime. Your hosting provider or server administrator must handle that layer.
Application updates
- WordPress core updates maintain WordPress itself.
- Plugin updates maintain individual extensions.
- Theme updates maintain the active design software.
- These remain important, but are not a substitute for the PHP security patch.
Hosting updates
- PHP is installed and operated on the server.
- The host may manage its updates automatically, or require action from your administrator.
- Selecting a PHP branch in a control panel does not prove its installed package is fixed.
- Ask for explicit confirmation covering both CVEs.
WordPress confirms that these issues are not specific to WordPress and that no WordPress update is required or planned to resolve them: Critical PHP Security Release — WordPress News .
How to check your WordPress PHP version
Start with the PHP version reported by the website itself, then confirm package status with your hosting provider.
Use WordPress Site Health
- Sign in to your WordPress administration dashboard.
- Open Tools → Site Health.
- Select the Info tab.
- Expand the Server section.
- Record the full PHP version shown.
These navigation steps are documented in WordPress’s official PHP update guide. For this incident, use PHP’s specific fixed-version list above—not a general recommendation such as “PHP 8.3 or higher”—to assess patch status.
If you have authorised shell access, this command shows the command-line PHP version:
php -vTreat that as an additional check, not proof of the web-serving runtime. Ask your administrator to verify the actual PHP handler serving the affected domain. Avoid publishing a public phpinfo page containing server configuration details.
PHP security update: a practical response plan
Prioritise internet-facing systems and applications that handle sensitive data. ENISA recommends identifying PHP applications, coordinating with service providers, and applying the released security updates. Read the joint security-agency statement.
Find every exposed PHP installation
Include production sites, subdomains, staging copies, APIs, and externally managed applications. Record the owner responsible for each hosting environment and its PHP updates.
Take a backup and assess compatibility
Preserve website files and the database. Confirm restore access and check critical integrations. Where available, use a short staging test without turning testing into an indefinite delay to patching.
Install the fixed package
Have the host or authorised administrator apply the appropriate supported-branch release or documented vendor fix. A branch upgrade may also require compatibility work for older application code.
Replace running vulnerable processes
Ask the administrator to restart or replace the affected running services and long-lived PHP processes. Containerised environments may need rebuilt images and redeployment.
Test the live customer journey
Check the homepage, administration login, contact forms, checkout, bookings, uploads, and other business-critical functions. Confirm which patched runtime is actually serving the domain.
Look for signs of compromise
Review logs, unusual crashes, changed PHP files, unfamiliar accounts, and unexpected processes. Patching prevents the fixed vulnerability from being reused; it does not remove an existing intrusion.
Supporting guidance: WordPress update preparation and Swiss NCSC patching, restart, verification, and anomaly-review recommendations .
Copy this message to your hosting provider
Ask for evidence of protection rather than a general statement that the hosting platform is secure.
Hosting support request
Subject: Urgent PHP patch verification — CVE-2026-109618 and CVE-2026-109619 Hello Support Team, Please confirm the protection status of every PHP installation serving my website and related subdomains. 1. What exact PHP runtime and package release are serving each domain? 2. Have both CVE-2026-109618 and CVE-2026-109619 been fixed? 3. If you use backported fixes, please provide the vendor advisory and installed package release. 4. Have the affected running PHP workers and services been replaced or restarted after patch installation? 5. Are staging sites and other PHP applications also covered? 6. If anything remains unpatched, what immediate isolation and remediation steps are available? Please provide written confirmation of completion and flag any compatibility issues requiring our attention. Thank you.
What if you cannot update PHP immediately?
PHP states that only an update is a complete solution. Temporary configuration changes and firewall rules may reduce exposure to particular attack paths, but do not establish that an affected installation is safe.
Escalate rather than assume protection
- Ask the host for an urgent supported fix or documented vendor patch.
- Have an experienced administrator evaluate PHP’s published temporary measures.
- Do not copy memory or request-handling settings into production without assessing operational impact.
- If protection cannot be established promptly, consider restricting or isolating the application until remediation is complete.
Sources: PHP’s mitigation limitations and ENISA’s isolation guidance.
Maintenance mode must not leave PHP exposed
A WordPress maintenance plugin is not a reliable isolation control for a flaw that may be reached before application code runs. Have the host implement any necessary access restriction at the appropriate server, proxy, or network layer.
If taking the site temporarily offline, use a PHP-independent maintenance response where needed. A short outage should return HTTP 503 rather than a normal 200 response containing an error message.
Persistent server errors can eventually cause URLs to leave Google’s index, so restore normal service promptly after securing the installation. Google’s HTTP status-code guidance.
How to verify the website is patched
Installing an update is only part of the response. Keep a simple record showing that the correct package is installed, the running service uses it, and the application still works.
The Swiss NCSC advisory explicitly recommends verifying the runtime in use, restarting affected processes, and checking for anomalies.
PHP security update FAQs
Direct answers for WordPress site owners, business managers, and teams coordinating with hosting providers.
Is every WordPress website already hacked?
No. Running affected software establishes exposure, not proof of compromise. Patch promptly and review the site for suspicious activity. A vulnerability announcement alone does not prove an intrusion.
Does updating a security plugin fix PHP?
No. PHP requires a server-runtime update or documented vendor patch. PHP states that no mitigation completely replaces the update. Official advisory.
Are PHP-FPM and LiteSpeed installations safe?
Do not assume so. PHP includes PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed in its web-request risk statement. It identifies mod_php as highest risk, not as the only affected configuration. PHP’s affected-environment guidance.
Do I need to jump straight to PHP 8.5?
Not necessarily. PHP released fixes for supported 8.2, 8.3, 8.4, and 8.5 branches. Apply an appropriate fixed release now, and separately plan migration based on compatibility and support timelines. Check PHP support dates.
Can I leave PHP 7.4 or 8.1 in place?
Those branches no longer receive normal upstream support. Any emergency source backport or vendor fix must be verified, and does not remove the need to plan a supported-version migration. Read the older-version guidance.
What if the website breaks after updating?
Escalate to your host and developer to identify compatibility failures. Do not simply restore an exposed PHP runtime to public service. Use a protected maintenance approach while repairing incompatible code or arranging a patched alternative.
Need help coordinating your website update?
Contact Aidin Digital to discuss your WordPress maintenance requirements, hosting coordination, compatibility checks, and post-update website testing.
Share your hosting provider and current PHP version. Do not send passwords, private keys, or hosting credentials through an unsecured message.
Keep the response evidence-based
This guide draws on PHP’s official advisory, WordPress documentation, security-agency guidance, and reporting about the emergency release. Hosting-specific actions should be agreed with your authorised administrator.
For additional reporting, read Wordfence’s PHP security update notice and Search Engine Journal’s PHP security coverage.
Security guidance changes as vendors release updates. Verify the latest official advisory and your actual installed package before declaring remediation complete.
My server had a similar issue where the update process failed completely. It showed a strange error code I had to research online.