Madiha Yaqoob
The PHP project released emergency security updates on October 21, 2026 for two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. The PHP site tells all users to update immediately and says updating is the only complete fix.
The details come from PHP’s own 2026 news archive, which carries the security advisory, the advance notice posted on October 20 and the release announcements.
Which versions have the fix
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all published on October 21. The upcoming PHP 8.6.0 RC4 test build also includes the fixes, but it is a pre-release and not meant for production. The advisory describes CVE-2026-109618 as remote code execution through out-of-memory corruption and CVE-2026-109619 as remote code execution through stale global state.
The PHP site also notes that PHP 8.2 reaches end of life on December 31, 2026. If your host is still on 8.2, this patch is a good reason to plan a move to a newer branch rather than only taking the point release.
Why WordPress owners should care
WordPress, Drupal, Joomla and Magento all run on PHP, so a flaw in the language itself reaches far beyond any single plugin. Reuters, as summarized in the TechStartups daily digest, reported that the EU’s cybersecurity agency warned some sites might need to be taken offline while patches were prepared, that Australia’s Cyber Security Centre issued similar guidance, and that Cloudflare saw early signs of attacks and updated its firewall rules. The original Reuters report also said the flaws could allow code execution without authentication. We could not open the Reuters page ourselves, so that detail is relayed from the digest.
A short patch checklist
Find your PHP version first. Most hosting control panels show it under a PHP or software section, and WordPress shows it under Tools, then Site Health, then Info, then Server. Then check that your PHP version is one of the fixed releases above, or that your host has applied the fix to its own build.
On shared hosting you usually cannot patch PHP yourself. Open a support ticket or look for a PHP selector and ask the host to confirm the patched version. Managed hosts often patch quietly, but confirmation in writing is worth having if you run client sites.
After the update, load your site, test the checkout or contact forms, and look at the error log for notices from older plugins. A major version jump can break outdated plugins, so take a backup before changing branches. If you manage sites for clients, send them a short note saying which sites were checked and when. That record is useful if a client asks later.
Keep a firewall in front of the site as well, since vendors like Cloudflare said they updated rules, but treat that as a stopgap. The patch is what closes the hole.
