Critical PHP Vulnerability CVE-2026-109618: What WordPress Site Owners Should Do Now

Short answer: On 21 October 2026 the PHP project fixed two critical security flaws, CVE-2026-109618 and CVE-2026-109619. Both allow an attacker with no login to run code on the server, and both are rated 9.2 out of 10. Almost every WordPress site runs on PHP, so if your server is not on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer), your site is exposed. Check your PHP version today and get your host to confirm the patch in writing.

What Happened, Day by Day

Reports also say technical details leaked online before the planned disclosure, which shortened the time site owners had between the warning and the first attacks.

The Two Flaws in Plain English

• CVE-2026-109618 (out-of-memory corruption). When a request makes PHP run out of memory part-way through, for example during a large upload, PHP can clean up data that was never properly set up. An attacker can shape that data and turn the crash into code execution.
• CVE-2026-109619 (stale state between requests). Internal data that belonged to one request can survive after it is freed and be used by the next request handled by the same PHP worker. The confirmed attack paths use PHP’s session upload progress feature.

The important part for business owners: the attack happens inside PHP, before WordPress, your theme or your plugins run. The PHP advisory names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as affected setups, with mod_php at the highest risk. Your security plugin cannot see it, and updating WordPress does not fix it.

Is Your Site Affected? A 5-Minute Check

1. Find your PHP version. In WordPress, open Tools → Site Health → Info → Server. Or check the PHP settings in cPanel, hPanel or your host’s dashboard.
2. Compare it with the fixed versions. You are patched if you are on 8.5.12+, 8.4.27+, 8.3.36+ or 8.2.35+ on the same branch.
3. Be careful with “8.x” labels. A hosting panel that only says “PHP 8.3” does not tell you the patch level. Ask for the full version number.
4. Old PHP is the biggest risk. PHP 8.1 and older get no official releases. Unless your host uses a distribution or long-term support build with the backported fix, an old version stays vulnerable.
5. Check every site. Staging copies, old landing pages and forgotten subdomains are often on older PHP than the main site, and attackers scan all of them.

What to Ask Your Hosting Company

Most small businesses are on shared or managed hosting, so the PHP update is the host’s job. Send them three questions and keep the reply:

• Which exact PHP version does my site run, and does it include the 21 October 2026 fixes for CVE-2026-109618 and CVE-2026-109619?
• When was it patched?
• Have you disabled session.upload_progress.enabled while CVE-2026-115560 is waiting for a fix?

Good hosts answered this publicly within hours. WPX, for example, published its patch timeline, and so did InMotion Hosting. If your host has said nothing three days later, treat that as an answer about its security. Our guide to choosing web hosting in India covers what to look for.

If You Manage Your Own Server or VPS

1. Update PHP now to the fixed release for your branch, or install your distribution’s security package. Restart every PHP-FPM pool, Apache or LiteSpeed process so no old worker keeps running.
2. Old branches: on 7.4, 8.0 or 8.1, use a vendor build with the backported patch, or plan a move to 8.3 or 8.4. Note that PHP 8.2 reaches end of life on 31 December 2026.
3. Temporary measures only if you cannot update today. The PHP advisory lists settings that reduce exposure, such as turning off session.upload_progress.enabled in php.ini or the FPM pool (not through .user.ini or ini_set()), and on PHP 8.5 setting fatal_error_backtraces=0. PHP is clear that these do not make a server safe. Read the full advisory before changing settings.
4. Check other software. Many products run PHP in the background. The Dutch NCSC keeps a list of affected third-party software.

Before You Switch PHP Version on a WordPress Site

Moving from an old PHP branch to a new one can break outdated plugins or themes. A safe order:

1. Take a full backup of files and database, and check that it can be restored.
2. Update WordPress core, themes and plugins first.
3. Switch PHP on a staging copy if your host offers one, and click through key pages, forms and checkout.
4. Switch the live site and test the contact form, logins and payments again.
5. Keep the error log open for a day to catch warnings.

A plugin that breaks on supported PHP is a risk on its own. Replace it rather than staying on unsupported PHP.

Signs Your Site May Already Have Been Hit

• New administrator accounts you did not create.
• Unknown PHP files in wp-content/uploads, or recently changed core files.
• Redirects to casino, pharma or betting sites, especially for mobile visitors or visitors from Google.
• Spam pages appearing in Google for site:yourdomain.com.
• Your host suspending the account for sending spam or using too much CPU.

Patching closes the door but does not remove anything an attacker already left behind. If you see any of these, change all passwords (WordPress, hosting, FTP, database), clean or restore from a backup taken before 21 October, and request a review in Search Console if Google shows a security warning. Hacked pages can damage rankings for months, as our technical SEO guide explains.

Sources

• PHP: Security advisory, critical RCE vulnerabilities (21 Oct 2026)
• PHP: Informational advisory, session upload progress (23 Oct 2026)
• ENISA: Joint statement on critical PHP vulnerabilities (21 Oct 2026)
• watchTowr: CVE-2026-109618 and CVE-2026-109619 FAQ
• Rapid7: Critical unauthenticated RCE in PHP
• WPX: Two critical PHP flaws, every WPX server patched in 90 minutes

Frequently Asked Questions

What are CVE-2026-109618 and CVE-2026-109619?

They are two critical vulnerabilities in PHP itself, disclosed on 21 October 2026. Both are rated 9.2 out of 10 (CVSS v4.0) and can let an attacker run their own code on a web server without logging in. CVE-2026-109618 involves how PHP cleans up after running out of memory; CVE-2026-109619 lets leftover state from one request be reused by the next request on the same PHP worker.

Which PHP versions fix the vulnerabilities?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026. PHP 8.1 and older no longer get official releases; patches for 7.4, 8.0 and 8.1 exist only for source builds or from Linux distributions and long-term support vendors.

Is my WordPress site affected?

Very likely, if it runs on an unpatched PHP version. The PHP project says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The bug is in PHP, so it does not matter which theme or plugins you use, and a WordPress update does not fix it.

How do I check which PHP version my WordPress site uses?

In WordPress go to Tools, then Site Health, then Info, and open the Server section. It shows the PHP version. Compare it with the patched versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer on the same branch.

Can a security plugin or firewall protect me instead of updating?

No. The PHP project says only an update is a complete fix. Some server settings and firewall rules reduce exposure to the known attack paths, but they do not make an installation safe, and the attack can start before WordPress or any plugin code runs.

What should I do if my host has not patched PHP?

Ask your host in writing which PHP version your site runs and whether it includes the 21 October 2026 fixes. If they cannot confirm a patched build, move to a supported, patched PHP version in your hosting panel, or move to a host that patches promptly. If neither is possible, the EU cybersecurity bodies advise isolating the site from the internet until it is fixed.