On 21 October 2026 the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a server without signing in. If your website runs on PHP, and every WordPress site does, this needs checking today. Here is what happened, what to do and how we handled it on the sites we run.
What are CVE-2026-109618 and CVE-2026-109619?
Both are flaws in PHP itself, each rated 9.2 on the CVSS v4.0 scale, and the PHP project calls them critical. They allow unauthenticated remote code execution: someone with no account on your site could make your server run their code.
- CVE-2026-109618: when PHP runs out of memory, it can be interrupted while its internal request data is only half set up, and the clean-up that follows may treat that invalid data as valid.
- CVE-2026-109619: internal data belonging to one request can outlive the memory it pointed to, and a later request on the same worker may use it.
Is your website affected?
Very likely, if it is built on PHP and has not been updated since. The advisory covers every PHP installation that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it rates the risk highest for mod_php.
Keeping WordPress, your theme and your plugins up to date is good practice and we recommend it in our WordPress security guide, but it does not fix this. The flaw sits in the layer underneath them.
What to do now
- Find your PHP version. In WordPress: Tools, Site Health, Info, Server.
- Update to a fixed release: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On managed hosting, ask your provider to confirm that it is done.
- Make sure the new version is really running. PHP workers must restart to load it.
- Back up first, then test. Check your home page, forms, checkout and admin area straight afterwards.
- Plan ahead if you are on an old branch. PHP 8.1 and older no longer get project updates, and PHP 8.2 reaches its end of life on 31 December 2026.
If you cannot update at once, the advisory lists interim settings. By its own account they reduce the exposure and do not remove it, and it says updating is the only safe choice.
How our team handled it
We look after the websites we build, on our own server, so this one was ours to deal with. The PHP project published the fixes on 21 October at 14:00 UTC. By 09:27 UTC the next morning, less than 20 hours later, our update was under way. This is what we did:
- A backup first. We saved the PHP configuration and the list of installed packages, so that we could go back if anything failed.
- Only what the fix needed. We upgraded the PHP packages and nothing else, and kept every site’s settings as they were.
- Every supported branch. We moved 8.2, 8.3, 8.4 and 8.5 to their fixed releases, not only the version our sites use.
- A check of every site. We loaded the websites one by one afterwards, including contact pages and translated versions, and confirmed that each one answered normally.
None of this is heroic. It is simply what maintenance and support is for: someone is already watching when the notice arrives, knows how the server is set up and has a way back ready. For more on what that work involves, see our website maintenance checklist.
Questions to ask whoever runs your website
- Which PHP version is my site on, and when was it last updated?
- How would you hear about a critical vulnerability, and how soon would you act?
- Is there a recent backup, and has anyone tried restoring it?
- Who checks the site after an update?
If those questions do not have quick answers, that is worth fixing before the next advisory arrives.
Frequently asked questions
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP project’s advisory. Your version number must be that release or later, or your vendor must confirm that it has backported the fixes.
Can a WordPress site be affected?
Yes, if the PHP underneath it is unpatched. The flaws are in PHP itself, so they do not depend on your theme or plugins, and updating WordPress does not fix them. The update has to happen on the server.
Does a firewall or a server setting protect me instead?
Not fully. The advisory lists interim settings that reduce exposure, and says that they do not make an installation safe. Updating is the only safe choice.
What if my site runs PHP 8.1 or older?
The PHP project no longer issues updates for those versions. The advisory says some vendors backport fixes, so ask yours, or upgrade to a supported version. PHP 8.2 itself loses security fixes on 31 December 2026.
How do I check which PHP version my site uses?
In WordPress, open Tools, then Site Health, then Info, then Server. Elsewhere, your hosting panel will usually show it, or your host or developer can tell you.
Not sure whether your site has been updated? Send us the address and we will tell you what to look at.
