Critical PHP Vulnerabilities Affect WordPress and Other Web Applications: CMS Updates Alone Are Not Enough
What Happened
On October 21, the PHP Security Team released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution.
The vulnerabilities exist in the PHP runtime itself rather than in a specific content management system. This means potentially affected environments include internet-facing applications built on PHP, including WordPress, Drupal, Joomla and many custom enterprise applications. The risk prompted a joint warning from the European Commission, ENISA, CERT-EU, Europol EC3 and the EU CSIRTs Network. Organizations were advised to identify PHP-based systems, prioritize internet-facing environments and apply the security updates immediately.
Why This Is Bigger Than WordPress
WordPress is often the first platform associated with PHP, but these vulnerabilities exist at a lower technology layer. They affect the runtime responsible for executing application code.
That distinction matters. Updating WordPress core, themes or plugins does not remediate these vulnerabilities if the server continues to run an affected PHP version.
The PHP Security Team states that PHP installations serving web requests may be affected across configurations including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. For mod_php, an exploit has been demonstrated in which an unauthenticated request can trigger the vulnerability before application code executes.
This turns the issue from a CMS update into a server and infrastructure remediation task.
How the Vulnerabilities Work
Both vulnerabilities involve unsafe memory handling.
CVE-2026-109618 involves conditions where PHP request processing can be interrupted while internal request data remains only partially initialized. Subsequent cleanup may then treat invalid data as legitimate.
CVE-2026-109619 involves request-related internal state that can remain available after the underlying memory has already been freed. A later request handled by the same worker may interact with that stale state.
In both cases, successful exploitation can result in an unauthenticated attacker executing arbitrary code on the affected server.
Which Versions Need to Be Updated
PHP released the following fixed versions:
-
PHP 8.5.12
-
PHP 8.4.27
-
PHP 8.3.36
-
PHP 8.2.35
The PHP project states that there are no complete alternative mitigations and that updating is the safe remediation path.
PHP 8.1 and older versions are no longer supported directly by the PHP project. Some Linux distributions and long-term-support vendors may provide backported fixes, but organizations need to verify this with their specific operating system or service provider.
What This Means for WordPress Environments
WordPress administrators often focus on keeping the CMS, plugins and themes current. This incident demonstrates why that alone is not sufficient. Website security also depends on the technology beneath the application: the PHP runtime, web server, operating system, hosting configuration and the way the service is exposed to the internet.
For managed or shared hosting environments, the PHP version may be controlled entirely by the hosting provider. In those cases, organizations should verify that the required security update has been applied rather than assuming that automatic WordPress updates have addressed the issue.
What Organizations Should Review
The first priority is to identify which internet-facing systems use PHP and determine the versions currently running. Organizations should then verify that the runtime has been upgraded to a fixed release or contains an officially backported security patch from the operating system or support vendor.
In larger environments, the review should extend beyond public websites. Internal portals, administrative interfaces, customer applications, legacy services and forgotten test environments may also expose vulnerable PHP installations.
Particular attention should be given to unsupported PHP versions, legacy applications that cannot be upgraded easily, forgotten subdomains, publicly accessible test systems and environments where ownership of the underlying PHP runtime is unclear.
DIAMATIX Comment
This incident demonstrates why vulnerability management cannot stop at the application layer.
An organization may have a fully patched WordPress deployment, current plugins and well-managed content, yet remain exposed because of a vulnerable component underneath the application.
These dependencies often create gaps between teams, providers and technology layers. The website owner manages the CMS. The hosting provider controls PHP. Another team may manage the operating system. The critical question is whether anyone has complete visibility across the stack.
For a vulnerability of this severity, the relevant question is not only:
“Did we update WordPress?”
It is:
“Is every layer the application depends on also updated?”
Practical Takeaway
CVE-2026-109618 and CVE-2026-109619 demonstrate why web application security cannot be separated from the infrastructure underneath it. WordPress, Drupal or another application can be fully patched while the underlying PHP runtime remains vulnerable.
The appropriate sequence is:
identify PHP systems → verify versions → patch the server layer → validate the application → monitor for suspicious activity.
Review not only your CMS version, but also the PHP runtime supporting your internet-facing applications.
Sources
-
PHP Security Team. Critical remote code execution vulnerabilities, update now, 21 October 2026.
-
PHP. PHP 8.5.12 Released, 21 October 2026.
-
ENISA, European Commission DG CNECT, CERT-EU, Europol EC3 and CSIRTs Network. Joint statement on critical PHP vulnerabilities, 21 October 2026.
-
Canadian Centre for Cyber Security. Critical vulnerabilities impacting PHP. CVE-2026-109618 and CVE-2026-109619, 21 October 2026.
-
Google Cloud Security. Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, 21 October 2026.
