Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated code execution. Updating WordPress won't fix them. Update and restart PHP.
On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service handling website traffic. We first alerted WordPress site owners to these updates in our initial public service announcement. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and each has a CVSS v4.0 score of 9.2 out of 10.
These are not vulnerabilities in WordPress Core, a plugin, or a theme. They are vulnerabilities in PHP, the programming language WordPress uses. Updating WordPress will not install the fixes. On most shared and managed hosting, the hosting provider controls PHP. Agencies and site owners who manage their own servers or containers must update the PHP package or image themselves.