Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619): What to Do Right Now

On 21 October 2026 the PHP project released four emergency security updates, all fixing the same two critical vulnerabilities. Both can allow unauthenticated remote code execution, and PHP runs a huge part of the web, WordPress included. This is what happened, who is really at risk, and what you should do today.

Last updated: 22 October 2026.

If you manage a website, an online shop or a custom web app, stop for ten minutes and read this. We are in the middle of patching servers for clients as we write, and the pattern is always the same: the sites that get hurt are the ones nobody looked at in time.

What happened

The PHP project published security releases for every supported branch: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Each announcement says they fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The advance notice of 20 October rated both CVSS v4.0 9.2, which is about as serious as it gets.

In plain words: somebody on the internet may be able to run their own code on your server, without logging in and without needing a vulnerable plugin or theme. The problem is PHP itself.

The two bugs, explained without the jargon:

• CVE-2026-109618 (RCE via OOM corruption). When PHP runs out of memory at the wrong moment, it can be interrupted while the data of a request is only partly set up. The cleanup that follows then treats that broken data as if it were valid.
• CVE-2026-109619 (RCE via stale global state). Some internal request data can survive after the memory behind it has been freed. A later request handled by the same worker process can then use that stale data before PHP resets it.

According to the official advisory the risk is highest with mod_php, where there is a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs. In practice that means protection living inside your application, like a WordPress security plugin, can’t be your only line of defence against it.

You may also see this circulating under nicknames such as “php2shell”. Nicknames come and go, so we stick to the CVE numbers: those are what you can look up in your hosting provider’s or Linux vendor’s advisories.

Does it really affect 70% of websites?

WordPress powers roughly 590 million websites globally, which is about 40% to 43% of all websites on the internet, and PHP powers, still in 2026, 69,3% of all known web.

But “runs on PHP” is not the same as “can be hacked today”. Whether a specific site is exposed depends on its PHP version, on how PHP is run (mod_php is the worst case), on its configuration, and on whether the host has already installed the fix.

The practical conclusion is the same, though. The number of potentially affected servers is enormous, the bug needs no login, and the technical details are public. Treat it as urgent.

Who should worry first

• Anyone on PHP 8.2, 8.3, 8.4 or 8.5 who has not updated yet. A fixed release exists, so there is no excuse to wait.
• Anyone on PHP 8.1 or older. The PHP project no longer updates these versions. It did provide minimal backports for 7.4, 8.0 and 8.1, but only for source builds or people without a long-term-support vendor. If this is you, the real fix is moving to a supported version.
• Apache servers running mod_php. This is the setup the advisory flags as highest risk.
• Shared hosting customers. You depend on your provider, so ask them which version you are on and whether the patch is installed.

One more thing: PHP 8.2 reaches end of life on 31 December 2026. Patching it today is right, but it only buys you a few weeks, so plan the move to 8.3 or 8.4 as well.

How to check your PHP version

• In WordPress: go to Tools, Site Health, Info, and open the Server section. The PHP version is listed there.
• In your hosting panel: cPanel has a MultiPHP Manager, other panels have a similar page, and it also lets you switch version.
• Over SSH: php -v shows the command line version, which is not always the one your website uses, so double check with the panel or Site Health.

A warning for Linux servers: Debian, Ubuntu, Red Hat and similar distributions backport security fixes into their own packages, so the version string can look old even when the fix is in. Check your vendor’s advisory or the package changelog for CVE-2026-109618 and CVE-2026-109619 rather than comparing numbers. The PHP project says vendors received the patches in advance, so updated packages should be available.

What to do right now

1. Make a full backup of files and database before touching anything.
2. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor’s patched package), or ask your host to do it.
3. Restart PHP-FPM or Apache afterwards. Running workers keep the old code in memory until they are restarted, and this step is the one people forget.
4. Update WordPress, themes and plugins while you are at it, so a newer PHP doesn’t meet outdated code.
5. Look for signs of intrusion: PHP files you don’t recognise (especially in wp-content/uploads ), recently modified files you didn’t touch, new admin users. Our emergency guide for hacked WordPress sites walks through how to clean up.

If you can’t update today

The official advisory lists a few settings that reduce exposure to specific attack paths. It is clear that only an update is a complete solution, and that these measures do not make an installation safe, so use them as a stopgap and nothing more.

For CVE-2026-109618:

• Set memory_limit=-1 , preferably in a way applications can’t override, such as php_admin_value in the FPM pool or in the Apache configuration. The trade-off is that a runaway script can use all the memory it wants, so limit memory with a container or cgroup instead. The advisory specifically advises against RLIMIT_AS and RLIMIT_DATA , as they can trigger the vulnerable allocation failure.
• Set post_max_size to 8M if you don’t need file uploads, or 32M if you do, and keep upload_max_filesize lower.

For CVE-2026-109619:

• Set session.upload_progress.enabled=0 and restart every worker.
• On PHP 8.5 only, also set fatal_error_backtraces=0 . According to the advisory this blocks the confirmed fatal backtrace path only.

Set all of these in php.ini , the FPM pool or the server configuration. Don’t rely on ini_set() or .user.ini files, as they don’t protect you here, and hiding errors with display_errors or error_reporting does nothing either.

Need a hand? We can patch it for you

If you don’t know how to fix it yourself, or you simply don’t have the time, get in touch with us. We have already patched over 40 servers in the past week, and we can check yours, update PHP, restart the services safely and make sure your site still works afterwards. Sending a message costs nothing, and we usually reply within 24 hours.

Why a quick patch isn’t always enough

Here is where things get complicated, and where we see most of the trouble.

On WordPress and WooCommerce sites, the PHP update is the easy part. The difficulty is an old plugin, an abandoned theme or a page builder that breaks on a newer version, which is the reason many sites are still running PHP 7 or 8.0 years after they should have moved. Cleaning that up, with updates, testing on a staging copy and proper ongoing maintenance, is part of our WordPress and WooCommerce services. If your site was built by someone who is no longer around, we can also take over and bring it up to date.

On custom PHP applications, the same problem is bigger. Internal tools, customer portals and old custom plugins often depend on code written for a PHP version that is now unsupported. We upgrade and modernise these apps, or rebuild the parts that can’t be saved, as part of our custom web app development work.

Security is never a one-off job, either. If you want to see how we think about protecting sites, have a look at pentesting and protecting your websites with AI, and why free security plugins give a false sense of safety. Our guide to fixing the most common WordPress problems is also worth bookmarking.

Frequently asked questions

Is my WordPress site affected by these PHP vulnerabilities?

If it runs on an unpatched PHP version, it can be. The bugs are in PHP itself, not in WordPress or any plugin, so a fully updated WordPress on an unpatched server is still exposed.

Can a security plugin protect me?

Not on its own. The advisory describes an exploit that triggers before any application code runs, so a plugin can’t be your only protection. The fix is the PHP update.

My hosting provider says it has patched the servers. Do I need to do anything?

Ask them which PHP version and package your site uses, and whether the workers were restarted. If you manage your own VPS or dedicated server, the update is your responsibility.

Is this being exploited already?

The PHP advisory says a working exploit has been demonstrated, and vendor posts report incidents, although we can’t independently verify those. The safest assumption is that attacks are already underway, or will be very soon.

I’m on PHP 8.1 or older. What should I do?

Plan an upgrade to a supported version as soon as you can. Official fixes are not provided for these versions, so staying put means staying exposed. Test the upgrade on a staging copy first, because older code often needs changes.