PHP patched two critical remote-code-execution flaws on 21 October. Here is what is confirmed, who is really at risk, and a plain checklist — no panic, no guesswork.
Verified against php.net and the php-src advisories on 22 October 2026.
On 21 October 2026 the PHP project published two critical flaws, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated attacker run code on the server under specific conditions. Both are CVSS 9.2. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
If your site runs on PHP (WordPress included), ask your host which PHP version you are on and whether it is patched. If your site is only static HTML, there is no PHP running on it to attack.
| Date | Event |
|---|---|
| 24 September 2026 | Earlier security releases: PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 |
| 20 October 2026 | PHP project gave advance notice of a critical security release |
| 21 October 2026 | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released; both advisories published |
| 21 October 2026 | PHP 8.6.0 RC4 includes the fixes (release candidate, not for production) |
| 31 December 2026 | PHP 8.2 reaches end of life |
| CVE-2026-109618 | CVE-2026-109619 | |
|---|---|---|
| Type | RCE via out-of-memory corruption | RCE via stale global state |
| Severity | CVSS v4.0 9.2 (Critical) | CVSS v4.0 9.2 (Critical) |
| Affected | Below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 | |
| Attack complexity | High | High |
| Authentication | None required | None required |
The advisories are specific about setups, and the risk is not equal everywhere:
session.upload_progress.enabled (on by default) and, on PHP 8.5, fatal_error_backtraces.Both flaws are rated high attack complexity: an attacker needs to line up specific conditions, such as a fatal error at the right moment and requests reaching the same worker. That lowers day-to-day risk compared with a one-click exploit. It does not make patching optional.
The advisory states that updating is the only complete mitigation. These steps reduce exposure but do not make an installation safe, and each needs a worker restart:
memory_limit=-1 in a way applications cannot override (for example php_admin_value in FPM or Apache config).post_max_size to 8M (no uploads) or 32M (with uploads), and keep upload_max_filesize below it.session.upload_progress.enabled=0 in php.ini or server config. ini_set() and .user.ini are not enough.fatal_error_backtraces=0.If you are not the person who manages the server, send this list to whoever is.
This part is our inference, not something the advisories say. WordPress, and most plugins and themes, run on PHP, so the PHP version on your server decides whether you are exposed. Updating WordPress or its plugins does not change the server’s PHP. On managed WordPress hosting the provider normally handles PHP; on a self-managed VPS or an old shared plan, you or your host must.
A website made only of static HTML, CSS and images has no PHP running to attack, so this class of problem does not apply to the site itself. That is a real property of static sites, but it is not a guarantee of safety: the server, any other applications on it, and how a contact form is handled still matter.
Disclosure: XAIWebsites is built by the same team behind XAIAgent (details). Sites it generates contain no PHP files. We mention it because it is relevant here, not because it replaces checking your own setup. If your site is the weak link, our free website audit is a low-effort first look.
If anything you run uses PHP, find the version today and get it to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later. It is a one-message job for most people on managed hosting.
The risk is real but conditional, and we do not know whether it is being exploited. Patch anyway — that is the only complete fix.
The PHP project published two critical advisories, CVE-2026-109618 (remote code execution via out-of-memory corruption) and CVE-2026-109619 (remote code execution via stale global state). Both are rated CVSS v4.0 9.2 and allow an unauthenticated attacker to run code with the web server's privileges, under specific conditions.
Everything below PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on the 8.2 to 8.5 lines is affected. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older no longer receive upstream updates, so they need vendor backports or an upgrade. PHP 8.2 reaches end of life on 31 December 2026.
WordPress runs on PHP, so the PHP version on your server is what matters; updating WordPress itself does not change it. The advisories do not name WordPress. Whether you are exposed depends on your host's PHP version and setup. Most managed hosts patch PHP for you, but you should ask rather than assume.
The advisories we read do not say either way, and we have not seen a confirmed report. Treat that as unknown, not as safe. Both flaws are rated high attack complexity, but the advisory says full remote code execution was demonstrated on Apache mod_php.
A site that is only static HTML, CSS and images has no PHP running to be attacked, so there is nothing of this kind to patch on the site itself. The server, any other applications on it, and contact-form handling are separate questions. Sites generated by XAIWebsites contain no PHP files.
The advisory says updating is the only complete fix and lists settings that reduce exposure without removing it: keep memory_limit at -1 in a way applications cannot override, keep post_max_size small (8M, or 32M if you need uploads), turn session.upload_progress.enabled off in php.ini and restart all workers, and on PHP 8.5 set fatal_error_backtraces to 0. Ask your host to do these, and update as soon as you can.
Ask your hosting provider, or look in your hosting control panel under PHP settings or PHP version. WordPress also shows it under Tools, then Site Health, then Info, then Server.
Facts on this page come from the PHP project’s own pages, read on 22 October 2026. Check them before acting; advisories can be updated.
Published 22 October 2026. The PHP project released the fixes and advisories on 21 October 2026. Advisories can change — check php.net before acting. See our methodology.