Critical PHP vulnerabilities put WordPress sites at risk
Critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 can expose WordPress sites even when WordPress Core, plugins and themes are fully updated. PHP, the programming language in which WordPress is primarily written, released emergency fixes on October 21, 2026. Both flaws have a Common Vulnerability Scoring System (CVSS) v4.0 severity score of 9.2 out of 10 and can allow remote code execution, meaning an attacker can make the server run commands, without first signing in.
These are server-level PHP flaws, not weaknesses in WordPress itself. Updating WordPress therefore does not install the required patches. The first PHP releases containing the fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions and long-term-support vendors may add the same patches to packages that retain older headline version numbers, so administrators must verify the complete package revision against the vendor's security notice. After installation, PHP must be restarted so that every active process loads the corrected code. Containers, which package an application with its runtime and dependencies, should be rebuilt and redeployed from an updated image.
Successful exploitation would give an attacker the same file and data access available to the website. According to the PHP project's advisories, that could enable the reading of database credentials, theft of site data, changes to website files or installation of a persistent backdoor, which is hidden access designed to survive after the initial intrusion. PHP confirmed remote code execution for both vulnerabilities and confirmed that one CVE-2026-109618 route executes before WordPress begins running. That distinction matters because a security tool operating only inside WordPress may never see the earliest part of such a request.
The two vulnerabilities reach code execution in different ways. With CVE-2026-109618, PHP can mishandle data when a request exhausts available memory. The resulting memory corruption, meaning data in working memory is changed in an unsafe way, can allow an unauthenticated attacker to execute code. With CVE-2026-109619, a PHP worker, one of the processes handling website requests, may continue using information left behind by a completed request. A later request assigned to that same worker can use the stale data to execute code.
CrowdStrike reports that its private exploit for the vulnerabilities worked reliably on Intel/AMD and Arm systems, including against PHP workers that had just been restarted. Wordfence said it had not independently tested that unpublished exploit. Public proof-of-concept material, which is demonstration code intended to show whether a flaw can be triggered, is already circulating, but Wordfence cautioned that some examples and commentary are incomplete, misleading or wrong. The need to tailor an exploit to a particular server does not establish that an unpatched installation is safe.
The Wordfence Threat Intelligence team examined PHP's patches and began laboratory testing within hours of their release. In a specially configured PHP 8.5.11 environment using Apache, software that accepts and serves web requests, its CVE-2026-109619 proof of concept arrived over HTTP and created a temporary text file. That confirmed code execution in that laboratory. The same test crashed a normal optimized build of PHP 8.5.11 rather than executing code, while corrected PHP 8.5.12 remained healthy.
For CVE-2026-109618, vulnerable PHP 8.5.11 failed when tested, while PHP 8.5.12 processed the same proof-of-concept request normally. In separate tests using WordPress 7.1.3 with an affected Ubuntu PHP 8.5.4 package, specially constructed requests caused PHP failures or restarts in some configurations. Wordfence did not independently obtain code execution for that CVE. These preliminary results show that behavior varies between server builds and configurations, but a crash instead of code execution is not evidence that an affected server is secure.
PHP 8.1 and earlier branches no longer receive releases from the PHP project. An operating-system or long-term-support vendor may still supply the patches, but operators need explicit confirmation. Otherwise, the site should be moved to a supported PHP branch. Site owners can see the version actually serving WordPress under Tools > Site Health > Info > Server. The result of running `php -v` at a command prompt is not enough because a server can use one PHP version for commands and another for websites.
Managed-hosting customers should ask whether the PHP service serving their site is patched for both CVEs and whether it has been restarted. Self-managed operators need to update PHP and restart Apache, PHP-FPM, a service that runs PHP processes, or whichever PHP service is active. Agencies and hosting providers should inspect every production site, staging site, meaning a separate test copy, direct origin address and older container rather than checking only the main public domain. Afterward, they should confirm both the Site Health version and the full package revision through the host, operating-system package tools or container image provider.
As a precaution, Wordfence recommends retaining backups and preserving web-server, PHP, firewall and system logs from at least the 48 hours before the October 21 release until PHP was patched and restarted. If the update was delayed, administrators should review those records for activity unusual for the site and investigate anything suspicious. Clean-looking logs cannot prove that exploitation did not occur. PHP's temporary recommendations may reduce exposure to particular attack routes when immediate patching is impossible, but they are incomplete, may interfere with normal site functions and are not substitutes for the update.
The Wordfence Firewall protects the WordPress application layer, the part that processes WordPress-specific requests, using Wordfence Threat Intelligence. It does not replace updates and controls for PHP, the web server, operating system and network edge, meaning the outer systems through which traffic reaches the site. Wordfence Care and Wordfence Response customers can contact its incident-response team if compromise is suspected; Wordfence says Response is available 24/7/365 with a one-hour response time.
This incident also shows the relevance of managed services for owners who do not administer PHP themselves: AEU Hosting provides managed WordPress hosting secured end to end. Regardless of hosting model, the essential response is to install a package confirmed to contain both fixes, restart PHP and verify the exact service and package that are serving the website.