PHP Vulnerability 2026: Fixes, Risks & WordPress Security

Your website is running smoothly. Your WordPress plugins are updated, your passwords are secure, and your security tools show no warning. But a vulnerability in the software powering your website could still leave your server exposed.

On October 21, 2026, two critical PHP vulnerabilities were disclosed that could allow attackers to execute malicious code remotely without authentication. Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws carry a reported severity score of 9.2 out of 10.

The warnings have raised concerns among website owners, IT teams and cybersecurity professionals. The vulnerabilities are not specific to WordPress. Any vulnerable server running PHP could be at risk.

For businesses, the priority is clear: identify affected systems, apply security patches and check for signs of compromise before a vulnerability becomes a serious security incident.

What Is the PHP Vulnerability?

PHP is a server-side programming language used by millions of websites, including WordPress-powered platforms. It processes requests and runs the code that makes websites function.

The two vulnerabilities involve how PHP handles memory and internal data.

• CVE-2026-109618: A memory-handling error may cause PHP to treat incomplete or invalid internal data as valid after an out-of-memory condition.

• CVE-2026-109619: Data left behind by an earlier request may not be cleared properly, potentially affecting a subsequent request handled by the same worker.

These weaknesses could enable remote code execution (RCE), allowing an attacker to run unauthorised code on a vulnerable server without logging in.

Depending on the server configuration and the attacker's access, successful exploitation could lead to data exposure, unauthorised system changes or further compromise.

Who Is at Risk?

The vulnerabilities affect PHP installations that serve web requests, including configurations using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

The risk is particularly serious for internet-facing servers running vulnerable PHP versions or systems that have not received the required security updates.

Organisations managing their own infrastructure should prioritise identifying affected systems. Businesses relying on third-party hosting should confirm whether their providers have deployed the necessary patches.

Are WordPress Websites Affected?

Yes. WordPress itself is not the source of these vulnerabilities, but a WordPress website may be exposed if its underlying PHP environment remains vulnerable.

Updating WordPress core, themes and plugins alone will not fix an unpatched PHP installation.

To check your PHP version, navigate to Tools → Site Health → Info → Server in WordPress. You can also find this information in your hosting control panel.

Contact your hosting provider to confirm whether the relevant security patches have been applied.

How to Fix the PHP Vulnerability: A Step-by-Step Guide

Step 1: Identify Your PHP Version

Start by checking which PHP versions your organisation uses across websites, applications, web servers, cloud environments and containers.

Create an inventory of affected systems and prioritise internet-facing servers. Knowing which systems are exposed helps your IT team focus remediation efforts where they matter most.

Step 2: Update PHP to a Patched Version

The PHP project has released the following patched versions for the affected release branches:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

Verify the appropriate version against the official PHP security advisory and your operating system vendor's guidance.

Before upgrading, back up essential data and test application compatibility where possible. Install the relevant update, restart or redeploy affected services as required, and verify that the patched runtime is active.

PHP 8.1 and older releases no longer receive regular upstream security updates. Organisations running unsupported versions should check whether their vendor provides backported fixes or plan a migration to a supported release.

Important: Temporary configuration changes may reduce exposure, but they are not a substitute for applying the appropriate security patch.

Step 3: Secure WordPress and Other PHP Applications

Once PHP is updated, review the security of the applications running on it.

• Update WordPress core, plugins and themes.

• Remove unused plugins, themes and applications.

• Review administrator accounts and access permissions.

• Check file permissions and server configurations.

• Confirm that security monitoring and backups are functioning correctly.

Remember that securing a website requires attention to both the application and the software supporting it.

Step 4: Monitor for Signs of Exploitation

Patching is essential, but it does not establish whether an attacker has already accessed your server.

Review web server, PHP and authentication logs for suspicious activity. Look for unexpected command-shell processes, unfamiliar files, unusual downloads and unauthorised system changes.

Investigate unusual outbound connections and other activity that may indicate a compromise.

If you suspect an attack, isolate affected systems where appropriate and preserve logs and other evidence for investigation.

Step 5: Strengthen Backups and Recovery

A strong backup strategy can make a significant difference when a cyber incident disrupts business operations.

Maintain regular, tested backups and keep an isolated copy disconnected from everyday systems. Protect backup accounts with strong, unique passwords and multi-factor authentication.

Test your recovery procedures periodically so your organisation knows how to restore systems and data when needed.

If an affected system cannot be secured promptly, consider isolating it from public access or taking it offline until adequate protection is in place.

What If the PHP Vulnerability Has Already Been Exploited?

Installing a security update closes the relevant vulnerability, but it does not automatically remove malicious code or reverse damage caused by an earlier attack.

If your server shows signs of compromise, a structured incident response process is essential.

Security teams should investigate how the attacker gained access, determine the extent of the compromise, assess potential data exposure and contain malicious activity. They should also preserve relevant evidence and verify that affected systems are safe before restoring normal operations.

Patching prevents known vulnerabilities from remaining open. Incident response helps organisations deal with attacks that may already have occurred.

Both are important parts of an effective cybersecurity strategy.

Beyond PHP: Other Cybersecurity Risks to Watch

Software vulnerabilities are only one part of the security challenge. Unapproved AI tools can also expose confidential business information when employees share sensitive documents, customer details or proprietary code without appropriate oversight.

Read our related blog, Shadow AI Risks: Prevent AI Data Leaks, to understand the risks associated with unauthorised AI tools and how organisations can reduce the chances of accidental data exposure.

Protect Your Business Before a Vulnerability Becomes a Breach

The latest PHP vulnerabilities highlight why cybersecurity requires more than routine software updates. Businesses need to identify weaknesses, monitor suspicious activity and prepare to respond when an attack occurs.

Applying security patches is essential, but what happens if your server has already been compromised?

WhiteKnight's incident response services help organisations investigate security incidents, contain threats and work towards secure recovery. If you suspect a server compromise or notice unusual activity, timely action can help limit further damage and support a structured response.

Don't wait for a vulnerability to become a business disruption. Strengthen your security readiness and know who to turn to when an incident occurs.

Need help responding to a cyber incident?

Contact WhiteKnight to discuss your incident response needs.