Critical PHP vulnerabilities: This update can’t wait
Well, this is not the kind of PHP update you want to postpone.
On October 21, 2026, the PHP team released emergency security patches for two critical vulnerabilities, both rated 9.2/10 on the CVSS scale.
The scary part? They could allow remote code execution (RCE) without authentication. In other words, someone could potentially execute malicious code on your server without even logging in.
And unlike the usual WordPress plugin vulnerability, this time the problem is in PHP itself.
What’s actually happening?
The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are related to PHP’s internal memory management.
The first involves memory corruption when PHP runs out of memory. The second involves internal data that can remain accessible after its memory has been freed.
Both can potentially lead to remote code execution.
And here’s the particularly unpleasant detail: with certain server configurations, notably Apache’s mod_php, an attacker could exploit the vulnerability before a single line of your application’s code even runs.
So no, updating WordPress, installing another security plugin or adding a few lines to functions.php won’t solve this.
What should you do?
Update PHP as soon as possible to one of these patched versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
If you’re using shared hosting, check whether your provider has already deployed the security patches. Some hosting providers may apply fixes directly to their existing PHP packages, so the version number alone doesn’t always tell the whole story.
And if you’re still running PHP 8.1 or older, remember that those versions no longer receive official security updates, although some vendors provide backported patches.
You can find the full technical details in the official PHP security advisory.
The important thing here is that this isn’t an application-level vulnerability. It affects the language running your application, whether that’s WordPress, Laravel or something entirely custom.
And with no complete workaround available, updating PHP is the only reliable fix.
So, maybe check your PHP version before getting back to whatever you were doing.
