30 October 2026
Late October 2026 saw the PHP project release emergency updates to fix two critical security vulnerabilities affecting the widely-used scripting language. WordPress site owners found themselves in an instructive position: their sites remained exposed to the flaws even as updates to the WordPress core itself were unaffected. Here's how the incident unfolded, and what it means for the ecosystem of software built on PHP.
The Vulnerabilities
On October 21, 2026, the PHP project published a press release unveiling the emergency updates. The security vulnerabilities were identified as CVE-2026-109618 and CVE-2026-109619. The updates fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with the recommendation to upgrade to PHP 8.4.27. The flaws were remote code execution vulnerabilities, allowing attackers to run code without logging into affected servers.
Explaining the severity of the issues, WordPress developer Matt Mullenweg told us, "These vulnerabilities are incredibly serious. They involve remote code execution on vulnerable PHP servers, so the impact is almost as broad as it is deep, and it means that simply patching WordPress isn't enough."
Both vulnerabilities were rated as "Critical" with a CVSS v4.0 score of 9.2, according to the PHP security team. In other words, the chances of exploitation were very high.
Why WordPress Sites Are Affected
Ultimately, the exposure extends to sites that run on PHP, not just WordPress. "WordPress sites are certainly affected, because they run on PHP," Mullenweg said. But crucially, because the vulnerabilities are in PHP itself, the issue is not specific to WordPress.
As described in the official advisories, the problem affects "any server that hosts a PHP application, and it is not specific to WordPress". In technical terms, the attacks are possible in all PHP installations serving web requests, including: Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. As Automattic's advisory noted, "The flaws are in the PHP Runtime itself, which means this will impact PHP-based content management systems like WordPress, Drupal, and Joomla, among many, many others".
Essentially, whereas an insecure WordPress update would only affect WordPress sites, a flaw like this one in a foundational piece of the web stack propagates to anything built on top of it. And PHP is used by roughly 80% of all websites, according to W3Techs.
More on this is available via https://1xbet-applications.com/.
What Site Owners Should Do Now
The official guidance from the PHP project, WordPress, and multiple government agencies including CISA boils down to this:
1. Check your PHP version. Owners can check their server's PHP version by going to Tools > Site Health > Info > Server in the WordPress dashboard. It's possible some sites are running on outdated PHP versions, because auto-upgrading is not suitable for all users.
2. Update to the latest PHP version that contains the fix. This typically means PHP 8.5.12, but specific compatible options differ based on the use case. Site owners are strongly advised to contact their hosting or development provider if they lack the know-how or access to upgrade PHP themselves. This is not an issue to leave unfixed, but that said, it's one that's definitely fixable with a relatively simple software update.
When to Consider Taking Systems Offline
As Mullenweg said, the vulnerabilities are so severe that "every site running a vulnerable version of PHP should be considered compromised", and for some it may be advisable to take systems offline until the updates are applied. Examples include older or unmaintained versions of software, companies that use specific versions of PHP, or developers deliberately keeping PHP outdated. This aligns with the official PHP project advisory.
Broader Impact on the Web Ecosystem
This incident is a poignant reminder that vulnerabilities can lurk at every level of the web stack, and that the modern web runs on a dizzying interconnectedness through complex and opaque codebases.
Most provocatively, a significant vulnerability in PHP is unlikely due to a rogue security audit. As David Anderson, editor for TechRadar Pro, addressed the possibility that the flaw could have failed more quietly, asking "which is more likely? That vulnerabilities so severe they need to be patched immediately and with such widespread impact to global Web shortly after release are the result of human oversight, or that they are the result of intentional vulnerabilities inserted by some adversary at some point in the PHP supply chain?" Anderson's speculative question aside, one takeaway from this incident is that any software, even core pieces like PHP, could be vulnerable to exploitation at critical times between versions.
