The short versionPHP announced an emergency security release for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2, scheduled for October 21, 2026 at 14:00 UTC. Details leaked first, and watchTowr confirmed the flaws were real. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them. Wordfence warned that automatic WordPress updates won't apply the fix, because PHP runs on the server, not inside WordPress.
PHP is the code under WordPress and most of the web, and two critical holes in it leaked online before the fix was ready. The fix is out now. The catch: WordPress can't install it for you.
What happened
On October 20, the PHP security team announced an upcoming security release "scheduled for Wednesday, 21 October 2026 at 14:00 UTC" (10:00 AM Eastern) to fix "two critical vulnerabilities, both rated CVSS v4.0 9.2." Details leaked before the embargo lifted. watchTowr posted on X: "Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real."
On October 21, PHP released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which "fix two critical vulnerabilities that can allow unauthenticated remote code execution" (CVE-2026-109618 and CVE-2026-109619).
The details
Early attacks. Cloudflare CTO Dane Knecht said: "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only," Reuters reported.
WordPress won't patch it. Wordfence warned that automatic updates would not apply the fix and advised site owners to find out who is responsible for updating PHP on their site, per Reuters.
Go offline if you can't patch. CERT-EU said organisations unable to patch should consider taking affected sites offline, and the UK NCSC gave similar advice for systems that can't be mitigated.
Old versions get no fix. GoDaddy says PHP 8.1 and older are no longer supported and won't get an official fix; plan to move to 8.2 or later.
Scale. PHP is used by 69.3% of websites whose server-side language is known, according to W3Techs.
Why brands should care
If your site runs on WordPress, WooCommerce or most other popular site builders you host yourself, it runs on PHP. A hacked site can leak customer data, get flagged by Google or sit offline. And because the fix lives on the server, the "auto-update" switch you trust in WordPress doesn't cover it.
What to do
Our suggestions, not official guidance:
- Check your PHP version. In WordPress: Tools > Site Health > Info > Server.
- Ask your host one question. "Is my site on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 yet?"
- On 8.1 or older? Ask about upgrading. Test the upgrade on a staging copy if your host offers one.
- Know who owns this. Write down who updates PHP on your site, so you're not guessing next time.
Sources
- PHP: security release notice and advisory (Oct 20-21, 2026)
- php.announce #509
- watchTowr on X (Oct 20, 2026)
- Reuters via The Independent
- Reuters via Devdiscourse
- BleepingComputer
- UK NCSC
- GoDaddy
- W3Techs
- WordPress.org: Update PHP
FAQ
Which PHP versions fix the October 2026 critical vulnerabilities?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026, fix CVE-2026-109618 and CVE-2026-109619.
Will WordPress automatic updates fix the PHP vulnerability?
No. Wordfence warned that automatic updates would not apply the fix and that site owners should find out who is responsible for updating PHP on their site, usually the web host.
How do I check my PHP version in WordPress?
In your WordPress dashboard, go to Tools > Site Health > Info > Server. If it shows PHP 8.1 or older, GoDaddy notes PHP will not release an official fix for those versions.
