PHP security updates fix two critical remote code flaws
PHP security updates are now available for two critical vulnerabilities in PHP, the programming language that processes server-side functions for websites. The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619. Both flaws can allow unauthenticated remote code execution, meaning an attacker could run their own code on a server without first signing in. The PHP project is strongly urging all users to update immediately.
In an advance notice issued on October 20, the PHP security team assigned both vulnerabilities a score of 9.2 under CVSS v4.0, the Common Vulnerability Scoring System used to rate security flaws. That places them in the Critical range. Wordfence recommends ensuring that every managed website is moved to a patched PHP release as soon as possible.
The issue directly affects WordPress because every WordPress site relies on PHP. However, the vulnerabilities are in PHP itself, not in WordPress, a plugin or a theme. WordPress automatic updates therefore cannot correct them. The PHP software installed on the web server must be updated separately, either by the hosting provider or by whoever manages the server.
According to the PHP security advisory, every PHP installation that serves web requests is at risk. The affected server configurations include PHP-FPM, a service that processes PHP requests separately from the web server, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers the danger greatest for mod_php. It has demonstrated an exploit in which an unauthenticated web request can trigger the vulnerability before any application code begins running. This means the website application itself does not get an opportunity to inspect or reject the request first.
Users of PHP 8.5 should install version 8.5.12, while PHP 8.4 installations should move to 8.4.27. PHP 8.3 is fixed in 8.3.36, and PHP 8.2 is fixed in 8.2.35. The PHP project says PHP 8.2 will reach end of life, the point at which it stops receiving official updates, on December 31, 2026. It will receive no PHP project security fixes after that date. PHP 8.1 and earlier releases are already outside the project's update support.
Some Linux distributions and long-term support, or LTS, vendors may still provide backported fixes. A backported fix applies a newer security correction to an older software release without changing it to the newest main version. Administrators using such packages should contact their vendor or consult its security notice, because the displayed PHP version may remain unchanged even after the correction is installed. The PHP security team has also made minimal source backports available for PHP 7.4, PHP 8.0 and PHP 8.1 for organisations that compile PHP from source or cannot obtain updates from an LTS vendor.
WordPress site owners can find their current PHP version by opening the WordPress dashboard, selecting Tools, choosing Site Health, opening the Info tab and expanding the Server section. If a hosting provider controls PHP, customers should check its status page or ask it to confirm that the server is running one of the fixed releases. A version number alone may not confirm protection when a Linux distribution or LTS vendor has applied its own backported package.
Administrators responsible for their own servers should first make a backup, then install the updated PHP packages supplied by their Linux distribution or LTS vendor. The PHP project says those vendors received the corrections in advance. PHP source downloads, along with Windows source packages and binaries, are available from the PHP downloads page.
People using the volunteer-maintained remirepo repository at rpms.remirepo.net should check for updated packages. The PHP advisory initially said the repository would not have updates on October 21, but the PHP Foundation subsequently reported that its maintainer was signing updated packages. The advisory nevertheless urges remirepo users to move to distribution packages or compile PHP from source so they can apply updates immediately.
The PHP project says updating is the only complete solution. Its advisory provides temporary measures for installations that cannot yet be updated, but these only reduce exposure to particular attack paths and do not make the affected installation safe. Administrators or hosting providers that need those measures should follow the advisory's instructions exactly rather than treating them as a substitute for a fixed PHP release.
Wordfence Threat Intelligence is investigating the vulnerabilities and says it will publish further information when necessary. Wordfence also states that its Care service provides incident response during business hours, while Response offers 24-hour availability throughout the year with a one-hour response time. For site owners seeking managed infrastructure rather than administering PHP themselves, AEU Hosting provides managed WordPress hosting secured end to end. Regardless of hosting arrangement, confirmation that the server-side PHP package has been patched remains essential.