Updated 22 October 2026. The latest PHP security vulnerabilities in 2026 require urgent attention from organisations running WordPress, online shops, portals and other PHP applications. On 21 October, the PHP project released fixes for CVE-2026-109618 and CVE-2026-109619, two critical flaws that can enable remote code execution without a login.
What to do now: ask your hosting provider or server administrator to confirm that the PHP runtime serving your website has been patched. A WordPress plugin update alone will not resolve these server-level vulnerabilities.
What are the latest PHP security vulnerabilities?
Both issues involve how PHP manages memory while processing requests. They have a CVSS v4.0 severity rating of 9.2. Remote code execution means an attacker may be able to make the server run code of their choosing.
CVE-2026-109618: out-of-memory corruption
If memory runs out while PHP is preparing internal request data, cleanup can encounter data that was never properly initialised. The PHP security team demonstrated unauthenticated code execution against Apache mod_php, including an attack path before website application code starts. Other configurations must also be assessed; PHP-FPM should not be treated as automatically safe. See the official out-of-memory advisory.
CVE-2026-109619: stale internal state
Internal information belonging to one request can remain accessible after its memory has been released. When the same worker handles another request, PHP may reuse that stale information. The official stale-state advisory explains the vulnerability and remediation.
Which websites are at risk?
The PHP project calls for action across installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Actual exploitability depends on the build and deployment. This is a PHP runtime issue, so having an up-to-date CMS does not by itself establish that the server is protected.
For WordPress, open Tools → Site Health → Info → Server to check the website’s PHP version. WordPress confirms that these flaws are not specific to WordPress and that a WordPress core release is not the fix. Read the WordPress security notice.
Potential impacts on your organisation’s website
A successful compromise could affect the information and files accessible to the PHP worker account. The consequences depend on permissions, application design and isolation. Possible business impacts include:
- Data exposure: readable application configuration may contain database credentials or service secrets, putting customer and operational records at risk.
- Website tampering: an attacker with write access could alter pages, insert malicious redirects or change customer-facing information.
- Service disruption: crashes, recovery work and containment can interrupt sales, enquiries, bookings or staff access.
- Persistent access: writable locations could be used to plant a backdoor that survives a PHP update.
- Recovery costs and loss of trust: investigation, rebuilding and customer communication can consume significant staff time.
These are potential outcomes of a compromised deployment, not a claim that every PHP website has been exploited.
How to fix the PHP security vulnerabilities in 2026
1. Find every PHP installation
Inventory production websites, subdomains, APIs, staging environments, containers and software that bundles PHP. Prioritise internet-facing services. Record the owner and patch status of each system so an overlooked application does not remain exposed.
2. Install a fixed PHP release
The PHP project’s 21 October security release identifies these fixed versions:
| PHP branch | Fixed release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Use the applicable fixed release or a newer security release. Some operating-system vendors backport fixes while retaining an older upstream version number; obtain confirmation from that vendor. PHP 8.1 and older are outside upstream support, so arrange a supported upgrade or a verified vendor fix. Refer to the PHP security release and upgrade guidance.
3. Verify the website is using the patched runtime
Take a recoverable backup and test compatibility promptly. Have the administrator restart or redeploy the relevant services so old workers do not keep running. Check the web runtime as well as command-line PHP: they can use different installations. Test logins, forms, uploads and checkout after the change, then record the result.
4. Contain exposure if patching is delayed
The PHP team provides temporary measures, but says only an update is a complete solution. Have an administrator evaluate its current advisory rather than copying isolated configuration changes. A WAF can add protection without proving the underlying runtime is safe. The NCSC recommends considering taking systems offline if remediation or temporary mitigation cannot be applied promptly.
5. Check for compromise
If a system may have been exposed, preserve relevant logs and investigate unexpected files, new administrators and suspicious activity. Patching closes the vulnerability but does not remove an existing backdoor. Where compromise is confirmed, involve incident responders, rebuild from trusted sources and rotate affected secrets after containment.
What should Tiwahost customers do?
Contact Tiwahost through your usual support channel with your domain and ask for confirmation of the PHP version or vendor security patch serving that website. Include any subdomains or additional applications. Keep the response in your organisation’s maintenance records. Visit Tiwahost for hosting information.
Frequently asked questions
Will updating WordPress or a security plugin fix this?
No. The PHP runtime needs its security fix. Continue maintaining WordPress, themes and plugins as part of normal website security.
Does a patched server mean my website was never compromised?
No. Patch status and incident status are separate checks. Investigate suspicious activity rather than assuming an upgrade removes any earlier intrusion.
What is the priority for website owners?
Confirm the patch with the person responsible for hosting, verify that the site still works, and keep a clear record of remediation across every PHP application.
