The PHP critical vulnerability October 2026 is one of the most serious security events the web has seen in years. On October 21, 2026, the PHP project released security updates fixing two critical flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Either flaw can let an unauthenticated attacker run code on your server, and for some setups the attack succeeds before any application code runs. If your site runs on PHP — and almost every WordPress site does — this update cannot wait.
The fix is straightforward: update PHP to a patched release. But updating WordPress, your theme, or your plugins will not help, because this flaw sits in the PHP engine underneath all of it. This guide covers what happened, which versions are safe, and exactly how to update PHP on WordPress.
What Is the PHP Critical Vulnerability October 2026?
The October 2026 PHP security release fixes two related flaws, nicknamed PHP2Shell by researchers, in PHP’s core request-handling code:
- CVE-2026-109618 — remote code execution through out-of-memory corruption. When a request pushes PHP past its memory limit, out-of-memory handling can interrupt request setup while internal data is only partly initialized, and cleanup code then treats that invalid state as valid — enabling code execution.
- CVE-2026-109619 — remote code execution through stale global state. Request-owned internal state can survive in memory after being freed, and a later request on the same worker can use that stale state before initialization resets it — again enabling code execution.
Both flaws are network-exploitable and need no authentication or user interaction. Every PHP installation serving web requests is in scope, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed — essentially every standard WordPress hosting setup.
PHP 8.3.36 Security Update: Which Versions Are Fixed
The PHP project shipped patched releases for all four currently supported branches on October 21, 2026:
| Your PHP branch | Minimum safe version | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Fixed release available |
| PHP 8.4 | 8.4.27 | Fixed release available |
| PHP 8.3 | 8.3.36 | Fixed release available |
| PHP 8.2 | 8.2.35 | Fixed release available |
| PHP 8.1 or older | No official release | Upgrade required |
Anything below the minimum safe version on a supported branch is vulnerable: PHP 8.3.35 and earlier are affected, while the PHP 8.3.36 security update closes both flaws. PHP 8.1 and older get no official patched release, only source-only backports most owners cannot install — so the realistic fix there is a version upgrade.
Why Mod_php Sites Face the Highest Risk
All affected setups are serious, but Apache servers running mod_php carry the highest practical risk. Researchers demonstrated unauthenticated remote code execution against mod_php before any application code runs, so your WordPress security plugins and theme protections never get a chance to act.
PHP-FPM deployments are also exploitable, and vendors reported attack attempts in the wild shortly after disclosure. That is why “just update WordPress” is dangerously incomplete: WordPress updates run on top of PHP and cannot fix a flaw in the engine beneath them.
How to Update PHP Version WordPress Site Owners Should Follow
On most hosting accounts, you do not update PHP yourself with a download. Your host installs and maintains PHP, and your control panel offers the versions the host has made available. Here is the process:
- Find your current PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server. Many hosts also show it in cPanel or their dashboard.
- Check whether the patched release is available. On PHP 8.2, 8.3, 8.4, or 8.5, look for 8.2.35, 8.3.36, 8.4.27, or 8.5.12 in your host’s version selector. If it is not listed yet, ask your host when it will be available.
- Back up your site first, including the database, before switching versions.
- Switch to the patched version. Select the fixed release in your hosting panel and save; the change usually takes effect within seconds.
- Verify the change. Reload Site Health and confirm the new version number, then check your homepage and a few key pages as a logged-out visitor.
- Check compatibility warnings. If your site shows errors after the switch, a plugin or theme may be incompatible with the newer PHP version — update it first rather than rolling back to a vulnerable version.
If you manage your own server, update via your package manager, then restart your web server and PHP-FPM workers. If you need help, reach out through our WordPress support services or contact page — but do not delay the patch while waiting for a reply.
Temporary Mitigations If You Cannot Update Yet
Updating is the only complete fix — the advisories state there is no generic configuration workaround. But if your host has not published the patched release yet, these interim steps can reduce exposure. They are stopgaps, not substitutes:
- Set memory_limit to -1, removing the memory limit one flaw abuses. Temporary only — an unlimited limit carries its own risks.
- Disable session upload progress (session.upload_progress.enabled to 0), closing off one attack path tied to the session extension.
- Restart PHP workers regularly so stale worker state does not linger across requests.
- Use a web application firewall such as Cloudflare’s WAF rules for these CVEs. WAF rules block known attack patterns but cannot fix the flaw.
Apply these mitigations in combination, not one at a time, and reverse the temporary settings once you have updated. Treat every day you remain unpatched as a day of elevated risk.
What to Do If Your Site Runs PHP 8.1 or Older
This group is larger than many expect: monitoring data cited in recent coverage found more than one in five live sites still run PHP 8.1 or older, with no patched build coming.
If that is your site, your plan is:
- Apply the interim mitigations above immediately, and put a WAF in front of the site if one is not already there.
- Plan a PHP upgrade now, not someday. Moving from 8.1 to 8.3 or 8.4 is a bigger change than a patch, so test on a staging copy first — most modern plugins and themes already support PHP 8.3.
- Use the upgrade as a performance win, too. Newer PHP is faster, so the upgrade usually improves load times. Our guide on how to speed up your WordPress site in 2026 covers PHP upgrades alongside caching and image optimization.
A small, rarely visited site is not safe: automated scanners probe every server they can reach, and an unauthenticated flaw is exactly what mass scanning looks for.
FAQ: PHP Critical Vulnerability October 2026
What is the PHP critical vulnerability October 2026?
A pair of critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619, patched on October 21, 2026. Both score CVSS v4.0 9.2 and allow unauthenticated remote code execution on PHP installations serving web requests.
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix both vulnerabilities. Any earlier release on those branches is affected. PHP 8.1 and older have no official patched release, only source-only backports for 7.4, 8.0, and 8.1.
Is my WordPress site affected even if WordPress itself is up to date?
Yes. The flaws are in the PHP runtime underneath WordPress, so updating WordPress core, themes, and plugins does not remove them. Only updating the PHP version to a patched release fully fixes the issue.
What is PHP2Shell remote code execution?
PHP2Shell is the name researchers gave to these two vulnerabilities. It describes the outcome: an unauthenticated attacker gains shell-level code execution on the server, potentially accessing application data and credentials available to the PHP process.
Conclusion: Update PHP Before Hackers Find You First
The PHP critical vulnerability October 2026 is not theoretical. Two CVSS 9.2 flaws, unauthenticated remote code execution, public exploit details, and confirmed attacks in the wild add up to one instruction: update PHP now. Check your version in Site Health, switch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 on your host, and verify the change took effect. On PHP 8.1 or older, start the upgrade plan today and apply the interim mitigations meanwhile.
For deeper technical detail, see the analyses from NetSPI and Bitsight, and the hosting-focused breakdown from mySites.guru. Then go update PHP — it is the single most important thing you can do for your site this week.
