Critical PHP Security Update: How to Protect Your WordPress Website

The critical PHP security update released on October 21, 2026, addresses two vulnerabilities that can allow attackers to run unauthorized code on affected web servers without logging in. For businesses using WordPress or other PHP applications, confirming that the update is installed should be an immediate priority. 

PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its security team urges affected users to update promptly because temporary configuration changes do not provide complete protection. 

Website owners should contact their hosting provider or server administrator to verify their patch status. A fully updated WordPress dashboard does not confirm that the server’s PHP runtime has received these fixes. 

What Is the October 2026 PHP Security Update? 

The release fixes two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both involve memory handling and can lead to unauthenticated remote code execution under exploitable conditions. Each received a critical CVSS v4.0 severity score of 9.2. 

Remote code execution means an attacker may be able to make the affected server execute malicious instructions. The potential impact depends on the permissions available to the PHP process and the resources it can access. 

These vulnerabilities require attention even when a website appears to work normally. Visible errors are not a reliable way to determine whether PHP is vulnerable or patched. 

CVE-2026-109618: Memory Corruption 

This flaw involves PHP running out of memory while internal request information is only partially initialized. During cleanup, PHP can incorrectly process that incomplete information. 

The official advisory confirms that exploitation can result in code execution with the web worker account’s permissions. Researchers demonstrated an attack against Apache with mod_php that operates before application-specific code begins running. 

CVE-2026-109619: Stale Internal State 

The second flaw involves internal information remaining accessible after the memory supporting it has been released. A subsequent request handled by the same PHP worker can encounter this stale information. 

Exploitation depends on factors such as application behavior, configuration and the internal state involved. The official advisory identifies multiple paths and explains why a generic configuration change cannot address every case. 

Which Websites Are Affected by the PHP Vulnerabilities? 

PHP’s advisory covers installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It identifies mod_php as the highest-risk configuration. 

Businesses should review every website and application that relies on PHP, including: 

• WordPress websites and WooCommerce stores. 

• Booking systems and customer portals. 

• Custom business applications. 

• Older websites hosted on subdomains. 

• Publicly accessible staging environments. 

Check each environment separately. Websites within the same business may use different hosting accounts, PHP versions or server configurations. 

An affected installation does not prove that a website has been compromised. It means its patch status needs confirmation. 

Which PHP Versions Include the Security Fixes? 

The first upstream releases containing fixes for both vulnerabilities are: 

Both official advisories identify these patched releases. Later releases within the respective branches that retain the fixes are also appropriate. 

A hosting setting displaying only “PHP 8.4” does not establish which maintenance release is active. Request the full version number or vendor package revision. 

Some vendors backport security patches into packages with older-looking version numbers. Ask for a vendor advisory confirming coverage of both CVEs before deciding whether such a package is protected. 

Why WordPress Updates Do Not Fix the PHP Vulnerabilities 

WordPress runs on the PHP software installed in its hosting environment. Updating WordPress core, themes or plugins does not install a new server PHP package. 

A website can therefore have current WordPress software while its underlying runtime still needs patching. A WordPress security plugin also cannot replace the PHP update. 

On shared or managed hosting, the hosting provider generally controls PHP packages. For a self-managed server, responsibility may sit with an internal administrator or contracted developer. WordPress recommends working with the hosting provider when updating PHP and checking application compatibility. 

How to Check Your PHP Version in WordPress 

To find the PHP version reported by WordPress: 

1. Sign in to your WordPress dashboard. 

2. Open Tools → Site Health. 

3. Select the Info tab. 

4. Expand Server. 

5. Record the complete PHP version. 

Compare this information with the PHP settings assigned to your domain in the hosting panel. Ask your provider to clarify any difference. 

If a developer checks through the command line, remember that php -v reports the command-line runtime. It may differ from the PHP installation serving website requests. 

Treat a version check as a starting point. Vendor backports and multi-server environments may require additional confirmation. 

How to Update PHP and Verify Your Website 

1. Ask Your Host to Confirm Both Fixes 

Open a support ticket covering CVE-2026-109618 and CVE-2026-109619. 

Request the active PHP release or package revision, confirmation that all relevant servers are covered, and completion of required restarts. If remediation is pending, ask for a specific completion time. 

Keep this confirmation in your website maintenance records. 

2. Verify Backups Before Making Changes 

Confirm that current backups of website files and the database are available. Establish who can restore them and how recovery would work. 

WordPress’s PHP guidance recommends backups, current themes and plugins, and compatibility preparation before an update. 

Use staging for a rapid check where available. Keep preparation focused so an unrelated migration or redesign does not delay the security patch. 

3. Install a Patched PHP Build 

For a website already using a supported branch, its patched maintenance release may address the immediate issue without requiring a branch change. 

Ask the administrator to follow the package vendor’s instructions and verify the active web runtime after deployment. 

If compatibility problems appear, work with the provider on a patched alternative or temporary isolation while the problem is resolved. 

4. Test Important Website Functions 

After updating PHP, verify the functions that support your business. 

Ask your developer to review PHP and server logs for new errors. Assign someone to confirm that testing is complete. 

5. Investigate Suspicious Activity 

Patching addresses the vulnerabilities but does not remove an existing compromise. 

Investigate unexpected PHP files, unfamiliar administrator accounts, unexplained redirects and unusual server activity. Preserve relevant logs and escalate concerning findings to your hosting provider or security specialist. 

SEJ’s reporting also recommends reviewing web shells, unauthorized accounts and unexpected file changes after patching. 

What Should You Do About Unsupported PHP Versions? 

PHP 8.1 and earlier no longer receive regular official updates. For this emergency, limited source backports were provided for PHP 7.4, 8.0 and 8.1. Some hosting providers and long-term support vendors may also supply patched packages. 

These exceptional fixes do not restore ongoing upstream support. Confirm immediate protection and arrange migration to a supported branch. 

PHP 8.2 also requires an upgrade plan because its upstream security support ends on December 31, 2026. Choose a newer branch based on compatibility and remaining support life. 

Can a Firewall Replace the PHP Security Update? 

A web application firewall can provide another defensive layer, but it does not fix the underlying PHP vulnerabilities. 

PHP states that temporary measures reduce exposure to specific attack paths without providing complete protection. Installing the security update remains necessary. 

If immediate patching is unavailable, escalate the issue and discuss temporary isolation. CERT-EU recommends considering isolation of affected internet-facing applications when immediate remediation is impossible. 

Confirm Your Website’s PHP Patch Status 

Contact your hosting provider to verify that every relevant website is running PHP with both fixes installed. Complete functional testing, investigate suspicious changes and assign an upgrade deadline for unsupported versions. 

Keep a named person responsible for each task so patching, verification and follow-up work reach completion.