PHP released emergency security updates on October 21, 2026. They address CVE-2026–109618 and CVE-2026–109619, each carrying a CVSS v4.0 score of 9.2. The first flaw enables code execution through out-of-memory corruption. The second involves stale worker state.

These are vulnerabilities in PHP, not in WordPress Core, a plugin, or a theme. Updating WordPress does not update the PHP service behind the site. An unauthenticated attacker who succeeds can gain the website’s access to files, credentials, and data, which may allow data theft, file changes, or a persistent backdoor.

PHP confirmed remote code execution for both flaws. It also confirmed an attack path for CVE-2026–109618 that can run before WordPress starts. CrowdStrike says its private exploit worked reliably on Intel, AMD, and Arm systems, including newly restarted PHP workers. Wordfence did not independently test that unpublished exploit, and an attack may still require adaptation to a particular server. An unpatched system should not be considered safe. Public proof-of-concept material is already circulating, but some examples are incomplete or wrong.

Wordfence Threat Intelligence began testing within hours of the fixes. In a specially configured Apache lab running PHP 8.5.11, a proof-of-concept for CVE-2026–109619 arrived over HTTP and created a temporary text file. That demonstrated code execution in the lab. The same test crashed a normal optimized PHP 8.5.11 build, whereas PHP 8.5.12 remained healthy. For CVE-2026–109618, PHP 8.5.11 failed on the test request and PHP 8.5.12 handled it normally. Separate tests used WordPress 7.1.3 with an affected Ubuntu package containing PHP 8.5.4. Specially prepared requests caused failures or restarts in some setups, but Wordfence did not independently achieve code execution for this CVE. Testing continues because behavior can differ between servers.

The first fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Operating-system and long-term-support vendors may backport the fixes without changing the main PHP version, so the complete package revision and the vendor’s security notice must be checked. PHP 8.1 and older no longer receive releases from the PHP project. Users on those branches need explicit confirmation from their vendor or should move to a supported branch.

Managed hosting customers should ask their provider whether both CVEs are fixed in the PHP service serving the site and whether PHP was restarted. Self-managed operators need to update PHP and restart Apache, PHP-FPM, or another PHP service. Containers must be rebuilt and redeployed from an updated image. Agencies and hosting providers should check production, staging, origin addresses, and older containers, not only the public site.

The active PHP version can be checked in WordPress under Tools > Site Health > Info > Server. A command-line `php -v` result may describe a different PHP installation. After the update, verify the version used by the site and the full package revision. Keep backups and retain web-server, PHP, firewall, and system logs from at least the 48 hours before the October 21 release through the patch and restart. Delayed updates warrant a review for unusual activity. Clean logs do not prove that exploitation did not happen.

PHP’s temporary recommendations may reduce exposure to particular attack paths if an update is not immediately possible. They are incomplete, may disrupt normal functions, and do not replace the update. The Wordfence Firewall protects the WordPress application layer, but these flaws affect PHP at the server layer and some attacks begin before WordPress loads. Wordfence therefore recommends separate controls and current patches for PHP, the web server, the operating system, and the network edge.