PHP’s official security archive published an advisory on October 21, 2026, covering CVE-2026-109618 and CVE-2026-109619. The article says both flaws can permit code execution without authentication, but contributes no new technical detail beyond the advisory and the patched releases reported earlier.

Its operational advice is to check the PHP runtime and its version, plus the applied fixes and the server configuration, rather than assume every PHP site is affected. The check must cover the runtime serving web requests through PHP-FPM or Apache, because the command-line version can differ. Administrators on older branches should consult their operating system or hosting provider’s security notice. VPS and dedicated-server operators should install the relevant update. Shared-hosting customers should ask whether both fixes are present and, if not, when a patched environment or migration will be available.

The guidance covers websites and web applications, plus APIs and backend services. WordPress.com users should follow the platform’s security notice. People running WordPress on their own hosting must coordinate with the host or patch the server themselves. Updating WordPress or adding a security plugin does not fix PHP. The article cites W3Techs for PHP’s broad presence among sites with a known server-side language and points readers to the official advisory.