Last Updated: 23 October 2026

 

WordPress makes it easy to build and manage websites, but keeping a website secure requires regular attention to the software running behind it. On 21 October 2026, the PHP development team released critical security updates addressing two vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

 

These vulnerabilities could allow an unauthenticated attacker to execute malicious code remotely on an affected server. Both have a critical CVSS v4.0 severity score of 9.2. PHP is an important part of most WordPress hosting environments. If the PHP runtime used by a website is vulnerable, the website and its hosting environment may be exposed to security risks. WordPress website owners, developers, and hosting administrators should check their PHP environments and ensure that the appropriate security updates have been applied.

 

What Are the PHP Security Vulnerabilities?

Both vulnerabilities affect how PHP handles memory and internal request data. They are issues within the PHP runtime itself, rather than vulnerabilities limited to a particular WordPress theme or plugin.

  • CVE-2026-109618: Out-of-Memory Corruption

This vulnerability relates to how PHP handles an out-of-memory condition while processing a request. Under certain circumstances, PHP may attempt to clean up internal request data that has not been fully initialized. This can result in memory corruption and potentially allow an attacker to execute malicious code remotely.

  • CVE-2026-109619: Stale Internal State

This vulnerability occurs when internal request-related data remains accessible after the memory associated with it has been released. A subsequent request handled by the same PHP worker may use this outdated state before it is properly reset. Under certain conditions, this can also lead to remote code execution. These issues can affect the underlying runtime used by a WordPress website. Updating WordPress itself, installing a security plugin, or changing your website password does not fix a vulnerable PHP installation.

 

Can These Vulnerabilities Affect WordPress Websites?

Yes. WordPress relies on PHP to process website requests, communicate with databases, run plugins, and deliver dynamic content. A WordPress website running on an affected PHP installation may therefore be at risk. The same concern applies to other PHP-based websites and applications hosted on the same server. Potentially affected environments include:

  • WordPress business websites and company portals.
  • WooCommerce stores and other e-commerce websites.
  • Blogs, news websites, and membership platforms.
  • WordPress websites using custom themes or plugins.
  • Websites hosted on shared hosting, VPS, or dedicated servers.

The risk depends on the PHP runtime and its security status, not simply on which WordPress theme or plugin a website uses. A website may continue to work normally even when the underlying PHP installation requires a security update. For this reason, website owners should not wait for an error or visible security problem before checking their environment.

 

Affected PHP Versions and Available Fixes

The PHP development team has released the following fixed versions:

PHP Branch Fixed Version
PHP 8.5 8.5.12
PHP 8.4 8.4.27
PHP 8.3 8.3.36
PHP 8.2 8.2.35

 

These releases address CVE-2026-109618 and CVE-2026-109619. Earlier versions within the affected branches should be updated to the appropriate fixed release.

 

PHP 8.1 and older versions no longer receive regular security updates directly from the PHP project. Some operating system vendors and extended-support providers may offer backported fixes for selected older versions, but this depends on the package and vendor. If your WordPress website uses an older PHP version, check whether a suitable security patch is available. Where possible, plan to migrate to a supported PHP version after verifying compatibility with your WordPress installation, plugins, themes, and other dependencies.

 

Do not rely on the displayed PHP version number alone to confirm that a system is protected, as some vendors apply security fixes through updated package builds without changing the main version number. For the complete technical details, refer to the  official PHP security advisory.

 

What Should WordPress Website Owners Do?

Keeping your website updated is an important part of reducing security risks. The following steps can help you maintain a safer WordPress environment.

1. Confirm Your Website's PHP Version

Check which PHP version your WordPress website uses. If you manage several websites, subdomains, or separate WordPress installations, check each one individually. Your hosting control panel or hosting provider can help you identify the PHP version used by your website.

2. Make Sure the PHP Security Update Is Applied

The required fix must be applied to the PHP runtime or the relevant vendor-maintained package. If your hosting provider manages the server, ask whether the appropriate security updates have been installed. If you manage your own VPS or dedicated server, work with your server administrator to update the relevant PHP packages. Changing the PHP version selected for a website does not necessarily update every PHP installation or server component. The actual runtime and package build must be checked.

3. Update WordPress Core, Themes, and Plugins

Keep WordPress core, your active theme, and installed plugins up to date. Although these updates do not replace the PHP security patch, they help address other known vulnerabilities that could affect your website. Remove unused plugins and themes when they are no longer needed. Before performing major updates, check compatibility and make sure a recent backup is available.

4. Back Up Your Website Regularly

Maintain backups of your WordPress files and database. A recent backup can help you recover from accidental changes, software problems, or security incidents. It is also important to ensure that backups can be restored successfully when needed. After applying updates, test your website's main functions, including forms, login pages, checkout processes, and other business-critical features.

5. Review Your Website for Suspicious Activity

Pay attention to unexpected changes, unfamiliar administrator accounts, suspicious files, unusual redirects, or other signs that your website may have been compromised. If you suspect an incident, investigate it promptly and seek assistance from your hosting provider or a qualified security professional. Installing a PHP security update does not automatically remove malicious files or undo unauthorized changes that may have happened before the patch was applied.

 

Is Updating WordPress Enough to Fix the Problem?

No. This is an important distinction for website owners. WordPress core, themes, and plugins are application-level components. PHP is part of the server environment that executes the application. Updating WordPress helps keep the application secure, but the PHP runtime must also be patched separately. Likewise, a website can use the latest WordPress version and still run on a vulnerable PHP installation. A complete maintenance routine should therefore cover both website-level updates and the security of the underlying hosting environment.

 

How Hosting and WordPress Maintenance Help

Managing a WordPress website involves more than publishing content and installing plugins. Regular maintenance helps keep the website updated, backed up, and operating as expected. Depending on the hosting and maintenance service you use, routine tasks may include:

  • WordPress core, theme, and plugin updates.
  • Website backups and recovery checks.
  • Malware scanning and security reviews.
  • PHP compatibility checks and coordination with the hosting provider.
  • Website functionality checks after important updates.

These tasks help reduce maintenance risks, but they serve different purposes. Website maintenance does not automatically mean the underlying server's PHP packages have been patched. If you use managed WordPress hosting, contact your provider to confirm that the required server-level PHP security updates have been applied. If your hosting and maintenance services are managed separately, make sure both the website maintenance provider and the hosting provider understand which responsibilities they handle.

 

What If You Use cPanel or Plesk?

The required security updates may vary depending on the hosting control panel, operating system, PHP packages, and server configuration. If your WordPress website runs on cPanel or Plesk, follow the relevant vendor's official security instructions or ask your hosting provider to verify the installed package versions. Do not assume that a standard control panel update or a PHP version change has necessarily patched every affected component. For platform-specific instructions, see the official references in the More Information section below.

 

How WordpressWebHosting.LK Can Help

At WordpressWebHosting.LK, we focus on WordPress hosting and helping website owners keep their online presence running smoothly. Good website maintenance involves keeping WordPress and its components updated, maintaining backups, monitoring for suspicious activity, and checking that the website continues to function properly. If your website is hosted with us and you are unsure whether these PHP security updates have been applied, contact our support team so the hosting environment can be checked.

 

Customers using WordPress maintenance services should also ensure that their maintenance arrangements cover the updates, backups, and checks required for their website. Server-level PHP patching should be confirmed separately with the hosting provider. Whether you operate a business website, an online store, or a personal blog, regular maintenance and timely security updates can help reduce avoidable risks. Visit WordpressWebHosting.LK to learn more about our WordPress hosting services.

 

Final Thoughts

CVE-2026-109618 and CVE-2026-109619 are critical PHP vulnerabilities that may allow unauthenticated attackers to execute malicious code on affected servers. WordPress website owners should check their PHP environment, confirm that the appropriate security patches are in place, and keep WordPress core, themes, and plugins updated.

 

Remember that updating the website and securing the underlying server are separate tasks. Both need attention to maintain a reliable and secure website. With the right hosting environment, regular backups, timely software updates, and ongoing maintenance, you can help protect your website and provide visitors with a more reliable online experience.

 

More Information

For official technical details and platform-specific remediation guidance, refer to the following resources: