PHP security updates close two critical RCE flaws
PHP security updates are available for two critical vulnerabilities that could let an unauthenticated attacker run code on a web server. The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address CVE-2026-109618 and CVE-2026-109619, and it strongly recommends updating immediately. PHP is the programming language used by the server to generate many websites, including every WordPress site.
Both vulnerabilities can enable remote code execution, meaning an attacker could make the affected server run code chosen by the attacker. Unauthenticated means that the attacker would not need to sign in first. In an advance notice issued on October 20, the PHP security team assigned both flaws a score of 9.2 under CVSS v4.0, the Common Vulnerability Scoring System used to describe the severity of security weaknesses. That score is in the Critical range.
These flaws are in PHP itself, not in WordPress core, a plugin or a theme. Consequently, WordPress automatic updates cannot install the required fixes. The PHP installation on the hosting server must be updated separately. Website owners should not assume that a fully updated WordPress dashboard means the underlying PHP environment is also protected.
According to the PHP security advisory, every PHP installation that serves web requests is at risk. The affected ways of running PHP include PHP-FPM, a process manager commonly used to handle PHP requests, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers the danger greatest with mod_php. It has demonstrated an exploit in which an unauthenticated request can trigger the vulnerability before WordPress or any other application code begins running.
The fixed releases are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. Sites on the PHP 8.5 branch should move to 8.5.12, those on 8.4 to 8.4.27, those on 8.3 to 8.3.36, and those on 8.2 to 8.2.35. The PHP project says PHP 8.2 will reach end of life on December 31, 2026, after which that branch will receive no further security fixes from the project. PHP 8.1 and older versions are already outside the project's update support.
Some Linux distributions and long-term support, or LTS, vendors may provide backported fixes. A backport applies a security correction to an older software release without changing it to the latest main version. Because of this, a patched installation supplied by a distribution or LTS vendor may continue to display the same PHP version number. Administrators in that situation need to check the vendor's security notice or ask their hosting provider to confirm that the relevant package contains the fix. The PHP security team has also published minimal source backports for PHP 7.4, PHP 8.0 and PHP 8.1 for people who compile PHP from its source code or cannot obtain patches from an LTS vendor.
WordPress users can find their reported PHP version by opening Tools, Site Health, Info, then expanding the Server section in the dashboard. If the host manages PHP, the next step is to contact its support team or consult its status page and ask whether the server has received one of the fixed releases or an applicable vendor backport. Owners of self-managed servers should first make a backup, then install the updated PHP packages supplied by their Linux distribution or LTS vendor. The PHP project says those vendors received the patches in advance. Source downloads, along with Windows source packages and binaries, are available from the official PHP downloads page.
Administrators using the volunteer-maintained remirepo repository at rpms.remirepo.net should check for updated packages. The PHP advisory initially said that the repository would not have updates on October 21, but the PHP Foundation subsequently reported that the repository's maintainer was signing updated packages. The advisory still encourages remirepo users to move to distribution packages or compile from source so updates can be applied immediately.
The PHP project says updating is the only complete solution. Its advisory describes temporary measures that can reduce exposure to particular attack paths, but it explicitly warns that these measures do not make an installation safe. Anyone unable to patch immediately should follow the advisory's exact instructions rather than treating a workaround as a permanent fix.
Wordfence says its Threat Intelligence team is investigating the vulnerabilities and will publish updates when necessary. It also says Wordfence Care customers can access incident response during business hours, while Wordfence Response provides availability 24 hours a day, 365 days a year, with a one-hour response time.
For site owners seeking help protecting the hosting layer as well as WordPress, AEU Hosting provides managed WordPress hosting secured end to end. Regardless of who manages the server, owners should obtain explicit confirmation that PHP has been patched rather than relying only on the version shown inside WordPress.