Emergency PHP Security Update: What WordPress Site Owners Should Do Now
The PHP project has issued an emergency security advisory for two critical remote code execution flaws. PHP is the language that runs WordPress and a large share of the web, so if your site is on WordPress, this one is for you. The fix is an update, and most site owners can do it in a few minutes from their hosting panel.
What: two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow remote code execution.
When: advisory dated 21 October 2026.
Who is affected: PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What happened
On 21 October 2026 the PHP security team published an advisory for two critical flaws. Remote code execution means an attacker could run their own commands on the server. The advisory describes the first flaw as a memory problem: if PHP runs out of memory at a bad moment, request data can be left half-prepared and later treated as valid. The second involves leftover internal state from one request that a later request on the same worker could pick up.
The project says updating is the only complete solution. The risk is described as highest for Apache servers using mod_php, where a request can trigger the problem before any application code runs. PHP 8.2 is also close to the end of its support life, on 31 December 2026.
Why it matters for WordPress owners
WordPress itself, your theme and your plugins all run on PHP, so a flaw in PHP sits underneath all of them. It does not matter how good your plugins are or how strong your password is: the problem is in the engine. That is why updating PHP is as important as updating WordPress. Hosting companies usually apply fixes on their servers, but not always on the same day, and sites on a fixed older PHP version may need you to change the setting yourself.
What to do now
Most hosts have a PHP version selector in the control panel. In Hostinger’s hPanel, for example, it is usually under Advanced, then PHP Configuration, though menus change. If you use a managed host, such as a WordPress-specific plan, the company may already be doing this for you, so check their status page or support chat. Make a backup before you change versions, and test the site afterwards. If a plugin breaks on the new version, ask its developer for an update rather than staying on an unfixed PHP.
The advisory lists temporary settings that reduce exposure to specific attack paths, but says they do not make a server safe. They are for server administrators and can affect uploads and error handling, so on shared hosting leave them to your host. Updating PHP is the real fix.
The short version
- Two critical PHP flaws were disclosed on 21 October 2026.
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer.
- Check your PHP version in WordPress Site Health, then your hosting panel.
- Back up first, then test the site after changing versions.
Other tech stories this week
The same day brought other headlines, reported by the news site Tech Startups: Meta reported third-quarter revenue of $64.6 billion and raised its 2026 capital spending forecast to between $135 billion and $145 billion; Barclays said it will cut about 5,000 jobs and linked this to AI-driven efficiency; and reports said the Chinese AI company DeepSeek is close to a funding round of about 100 billion yuan. Treat these as reported figures that may change.
Sources
- PHP.net, security advisory of 21 October 2026 (primary source for versions and mitigations)
- Tech Startups, Tech News Today, 22 October 2026 (other stories)
This is a news summary written in our own words. For technical details, always read the official advisory. This is general information, not a guarantee of security.
