Critical PHP security fixes released on 21 October 2026

In short

• On 21 October 2026, the PHP project published fixes for two critical vulnerabilities that it says can allow unauthenticated remote code execution: someone could run their own code on an affected server without logging in.
• The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP.net says all PHP users are strongly encouraged to update immediately.
• WordPress runs on PHP, so most WordPress websites rely on their hosting provider updating PHP on the server. Updating WordPress itself does not update PHP.
• US cybersecurity agency CISA said it had not observed exploitation of these vulnerabilities at the time of its alert (21 October 2026).

What happened?

PHP is the programming language that powers WordPress and a large share of the web. On 21 October 2026, PHP.net published a security advisory titled "Critical remote code execution vulnerabilities, update now", alongside new releases for every supported version of PHP.

The two vulnerabilities are:

• CVE-2026-109618 ("RCE via OOM corruption"): PHP's handling of running out of memory can interrupt it while internal request data is only partly set up, and the clean-up that follows can then treat that invalid data as valid.
• CVE-2026-109619 ("RCE via stale global state"): internal information belonging to one request can survive after its memory has been freed, and a later request handled by the same PHP worker may use it.

The PHP project's advisories on GitHub rate both as critical (CVSS v4 score 9.2). CISA's alert refers to the pair as "php2shell".

Who is affected?

According to PHP.net, the risk applies to all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP.net considers the risk highest for Apache with mod_php, where it says it has a demonstrated exploit that works before any website code runs.

In practice, that means the question for most business owners isn't "is my website affected?" but "has my hosting provider updated PHP?"

Which versions fix it?

There are two different things to keep apart: which releases contain this specific fix, and which PHP versions are still supported in general. The table shows both.

* PHP 8.1 and older no longer receive updates from the PHP project. PHP.net says some Linux distributions and long-term-support vendors provide backported fixes, and, because of the severity, the PHP security team also published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build PHP themselves. If your site runs one of these versions, ask your host what they've applied, and plan an upgrade.

Note that being on a supported branch isn't enough on its own: a site on PHP 8.3 is only protected against these two vulnerabilities from 8.3.36 onwards (or if the host has applied the fix another way).

What WordPress site owners should do

1. Find your PHP version. In WordPress, go to Tools → Site Health → Info → Server. Step-by-step guide.
2. Check it. Enter it in our PHP version checker, which compares it with the fixed releases above and PHP's support dates.
3. If it's older than the fixed release, ask your host. Many hosts, and Linux distributions such as Ubuntu and Debian, apply security fixes to PHP without changing the main version number. PHP.net says distributions received the patches in advance. So an older-looking number doesn't automatically mean you're unprotected, but your host is the only one who can confirm it.
4. Keep everything else updated too. This fix is in PHP itself, so it doesn't replace keeping WordPress, plugins and themes up to date.

A useful question for your host: "Has the PHP on my hosting been updated for CVE-2026-109618 and CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or an equivalent vendor patch)?"

If you manage your own server

Update to a fixed release, or install your distribution's updated PHP packages, and restart every PHP worker (PHP-FPM pools, Apache, LiteSpeed and so on). PHP.net lists interim measures for anyone who can't update immediately (for example disabling session.upload_progress.enabled and lowering post_max_size), but stresses that they reduce exposure to specific attack paths and do not make an installation safe. Read the full PHP.net advisory before relying on them. CISA additionally advises patching internet-facing systems first, and monitoring for PHP worker processes launching shells or downloading tools.

Is it being exploited?

At the time of its alert on 21 October 2026, CISA said it had not observed exploitation of these vulnerabilities. That can change quickly after details are published, which is why the official advice is to update straight away rather than wait. We'll update this page if authoritative sources report exploitation.

Host Dada customers

If you host with Host Dada and want to confirm the PHP version and patch status of your hosting, please open a support ticket. If your website is hosted elsewhere and you'd like help understanding your results, you can run our free check and send us the report.

Sources

• PHP.net: Security advisory: Critical remote code execution vulnerabilities, update now (21 October 2026)
• GitHub php-src advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618): RCE via OOM corruption (21 October 2026)
• GitHub php-src advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): RCE via stale global state (21 October 2026)
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (21 October 2026)
• PHP.net: Supported versions (21 October 2026)

This page is general information for website owners, not professional security advice for your specific systems.