Critical PHP Vulnerabilities (CVE-2026-109618 / 109619): What WordPress Site Owners Must Do

On October 21, 2026, the PHP team released emergency security updates for two critical vulnerabilities that can lead to remote code execution (RCE) and affect all actively supported PHP branches. Since WordPress runs on PHP, every WordPress site owner should pay attention. This post explains what the flaws are, who is affected, and what to do today.

Summary: What happened?

• Fixed releases were published for PHP 8.5, 8.4, 8.3 and 8.2: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Two separate flaws were announced: CVE-2026-109618 and CVE-2026-109619. Both can lead to remote code execution.
• According to the PHP project, the highest risk is with mod_php setups, where unauthenticated requests can trigger an attack before any application code runs.
• PHP-FPM, php-cgi, FrankenPHP and LiteSpeed deployments are also affected.
• PHP 8.1 and older no longer receive official updates from the PHP project.

What do the vulnerabilities actually do?

CVE-2026-109618: Corrupted request data on out-of-memory

PHP's handling of out-of-memory conditions can interrupt a request while its internal data is only partially initialized. The cleanup step at the end of the request may then treat that invalid data as valid, leading to memory corruption and a risk of code execution.

CVE-2026-109619: Stale global state

Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker process may use that stale state before normal initialization resets it.

Full details are in the official PHP announcement (GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp).

Are "70% of websites" really at risk?

A La Presse article dated October 21, 2026 claims that a critical flaw threatens roughly 70% of websites. PHP is known to power a large share of the web, but we could not verify the 70% figure against primary sources, and PHP's own announcement gives no such percentage. The fair reading: the number is an estimate from the news outlet, but the pool of potentially affected sites is genuinely very large. No need to panic, but postponing the update is not wise either.

Is your WordPress site affected?

There is no flaw in WordPress core; the problem is in PHP itself. Keeping WordPress, plugins and themes up to date is therefore not enough on its own: the PHP version on your server must be updated too. On shared hosting, the provider usually handles PHP updates; on a VPS or your own server, it is your responsibility.

What to do today: step-by-step checklist

1. Find your PHP version. In the WordPress dashboard: Tools › Site Health › Info › Server.
2. Take a backup first. Back up files and database before updating PHP so you can roll back if something breaks.
3. Move to a fixed version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer). Use the updated package from your Linux distribution or hosting provider.
4. Ask your hosting provider. Ask in writing when they will apply the patch and whether you need to do anything.
5. If you run PHP 8.1 or older, remember it receives no official updates; plan a move to a supported version. PHP 8.2 reaches end of life on December 31, 2026.
6. Test after updating: check the home page, login, checkout and forms.

Temporary mitigations if you cannot update yet

The PHP announcement lists mitigations that are incomplete and not a substitute for updating. They are meant for server administrators:

• For CVE-2026-109618: set memory_limit=-1 and tighten request size limits (post_max_size, upload_max_filesize) to what your application needs. Apply it with php_admin_value in the FPM pool or Apache configuration so the application cannot override it. Also enforce request size, field count and header count limits at the web server or proxy level.
• For CVE-2026-109619: set session.upload_progress.enabled = 0, in php.ini or the pool configuration, not via ini_set(). On PHP 8.5 only, also set fatal_error_backtraces = 0.

Note: these changes may affect how your site works; see the official PHP announcement for details.

If you manage multiple sites

For agencies and multi-site businesses, the real challenge is tracking which PHP version each site runs and whether its backup is current. With WP Safer you can manage all your WordPress sites from one dashboard and confirm that backups are fresh before a risky change like a PHP update. If something goes wrong afterwards, restoring from a backup turns a crisis into a routine task.

Frequently asked questions

Does the PHP flaw directly affect WordPress?

The flaw is in PHP, not WordPress, but because WordPress runs on PHP your site can be affected indirectly. The fix is to update PHP.

Which PHP version should I move to?

Depending on your branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Prefer the newest supported branch if possible.

I use shared hosting. What should I do?

Ask your hosting provider when the PHP patch will be applied, and take your own backup in the meantime.

I run PHP 8.1. Can I get a patch?

The PHP project does not publish official updates for 8.1 or older; only limited backports for some older versions exist on GitHub branches. Moving to a supported version is the safest path.

How do I know if my site was compromised?

Signs include unexpected file changes, unknown admin accounts, and sudden spikes in traffic or resource usage. If in doubt, restore from a clean backup and change your passwords.

Conclusion

PHP's October 21, 2026 announcement deserves to be taken seriously: fixed releases are available and the steps are clear. Back up, update PHP, test your site. Half an hour of maintenance today is far cheaper than days of cleanup after a compromise.

Sources: PHP.net security announcement, October 21, 2026; La Presse, October 21, 2026.