Reporting checked against the linked primary sources on October 25, 2026. The incidents described occurred earlier that week.
News update — October 25, 2026. The PHP security team released emergency fixes on October 21 for two serious flaws that can, under vulnerable conditions, allow attackers to execute code on web servers without signing in. Anyone running websites or applications built on PHP should check whether their hosting environment has received the patched release.
The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. PHP’s official advisory says the affected attack paths involve internal request handling, not a particular WordPress plugin or theme.
What was fixed?
PHP’s security team released patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For hosted environments, the relevant question is whether the provider has deployed the fix or an approved backport for the PHP branch in use. Some Linux distributions may ship vendor-specific package versions that include backported fixes.
Both issues can allow unauthenticated remote code execution in certain circumstances. They involve memory handling and state retained between requests. These are server-side concerns, so a person browsing a website cannot fix them by clearing cookies or installing an antivirus extension.
Does this affect WordPress sites?
WordPress typically relies on PHP, which means the underlying runtime matters. That does not mean every WordPress site has been compromised or that every hosting plan runs an unpatched version. Site owners should check their hosting dashboard or contact the provider to verify the exact patched build or backported security status.
Before making changes to a production site, create a backup and test compatibility. Updating PHP can expose incompatibilities with old plugins or themes, but leaving a critical flaw unpatched is not a long-term option.
What should site owners do today?
- Identify the active PHP version through the hosting dashboard, not an untrusted online scanner.
- Confirm the server is running a patched or vendor-backported build.
- Update WordPress core, plugins, and themes separately; those updates do not automatically replace a vulnerable PHP runtime.
- Review authentication, backups, logs, and hosting alerts for unusual activity if there is reason to believe the environment was exposed.
- Ask the hosting provider for help if you cannot control the PHP runtime yourself.
On October 23, the PHP team also issued an additional informational note about a rare session-upload configuration that could require a defensive setting until a later release. That is a narrower concern and does not replace the urgent fixes for the two major vulnerabilities.
What we know — and what we don’t
The official release confirms the vulnerabilities and the available patches. It does not establish that a particular WordPress website was attacked. Claims about widespread successful compromise should be checked against incident reports and reliable technical evidence.
CyberUnpacked takeaway: if you run a PHP-powered site, verify its patched runtime now. Don’t assume WordPress auto-updates have fixed the server beneath it.
Primary sources
- PHP security advisory and releases, October 21–23, 2026
- PHP 8.5.12 official release
- CISA advisory on critical PHP vulnerabilities