Two critical flaws, fixed in supported branches
The PHP project issued security releases on October 21, 2026 for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The updates address CVE-2026-109618 and CVE-2026-109619, vulnerabilities the PHP team says can permit unauthenticated remote code execution. In plain language, remote code execution means an attacker may cause a server to run code through a network request; unauthenticated means the request does not first require a valid account. The project rates the issues critical and urges users to update.
PHP’s advisory describes different internal failure conditions behind the two CVEs. This article does not reproduce exploitation details. The operational point is that the PHP runtime processes requests before application-level protections can necessarily help, so a plugin firewall or hiding error messages is not a substitute for a patched runtime. PHP says there are no complete mitigations and that updating is the safe choice.
Check the runtime that serves requests
A WordPress, WooCommerce or custom site is not automatically vulnerable simply because it uses PHP. Exposure depends on the PHP build, the server interface, configuration, vendor patches and whether the hosting provider has applied the relevant fixes. The PHP project says web-serving installations are in scope across PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, and identifies mod_php as the highest-risk setup. Linux distributions and long-term-support vendors may ship backported fixes under their own package versions.
Start by identifying the PHP version actually used by the production website, not just the command-line version on a developer laptop. Managed WordPress hosts often provide a control panel or support channel for runtime versions. Shared-hosting customers can ask which patched package is active and when the runtime will restart. If you manage the server, compare the package to the official advisory and your operating-system vendor’s security notice; a vendor may backport a fix without adopting the upstream version number.
Update with a short, controlled test
For a self-managed environment, take a current backup and confirm that it can be restored. Apply the vendor’s patched package in staging where possible, then exercise the site’s important paths: sign-in, forms, scheduled jobs, media uploads, checkout, integrations and administrative tasks. Check error logs and background workers as well as the homepage. If the site has a custom extension or an older dependency, test it against the newer runtime before changing production.
A hosting provider may apply a security update centrally, but the customer still needs to confirm that the production runtime is covered and that the site is healthy afterward. Avoid delaying a security fix for an extended redesign or migration. If a compatibility issue blocks an update, ask the provider or developer for a specific remediation and a time-bound plan; do not assume an unrelated application-layer workaround neutralizes a runtime vulnerability.
Plan beyond the immediate patch
PHP 8.2 is scheduled to reach end of life on December 31, 2026 according to the PHP project. Its 8.2.35 release is a current patch for this advisory, but it does not extend the branch’s support lifetime. Teams still on 8.2 should schedule a compatibility review and move to a supported branch before security maintenance ends. For PHP 8.1 and older, the upstream project no longer issues fixes; some operating-system and hosting vendors may provide backports, so verify the provider’s exact coverage.
Keep a simple inventory of sites, runtime versions, owners and update channels. That makes the next security notice easier to route and reduces uncertainty about who can patch a shared-hosted installation. The immediate action is to verify the live runtime and patch status with the entity that operates it, then test the site. Do not infer compromise from the advisory, and do not infer safety from the fact that a site is built with WordPress.
Sources & further reading
Have a factual correction or a source to suggest? Contact the editorial desk.
