A WordPress update will not fix a vulnerable PHP runtime. Two critical flaws, CVE-2026-109618 and CVE-2026-109619, affect the server-side language beneath many WordPress installations and other web apps, potentially allowing an attacker to run code remotely without an account, password, or prior access to the server. Both issues carry a 9.2 out of 10 severity score.
The urgency is not theoretical: public services in several European countries were reportedly taken offline as a precaution while fixes were deployed. For site owners, the important detail is the full PHP version. A hosting panel that simply reports “PHP 8.3” does not establish that the site is protected; the patched release in that branch is PHP 8.3.36.
Check the exact runtime your site uses
The affected releases and first fixed builds are listed below. Linux distributions and long-term-support hosting platforms may backport the fixes, so a version number that differs from PHP.net’s upstream release can still be protected—but the provider should explicitly confirm remediation for both CVEs.
| PHP branch | Vulnerable versions | First fixed version |
|---|---|---|
| PHP 8.5 | Earlier than 8.5.12 | 8.5.12 |
| PHP 8.4 | Earlier than 8.4.27 | 8.4.27 |
| PHP 8.3 | Earlier than 8.3.36 | 8.3.36 |
| PHP 8.2 | Earlier than 8.2.35 | 8.2.35 |
| PHP 8.1 or older | Unsupported branches | Upgrade or provider-confirmed fix |
PHP 8.2 is scheduled to receive official fixes only through December 31, 2026. Minimal patches were prepared for PHP 8.1, 8.0, and 7.4, primarily for organizations building PHP from source, but moving to a supported branch remains the recommended path.
Why application-level security may not be enough
One flaw involves PHP’s handling of memory exhaustion during request processing, including scenarios involving uploads. The other can expose stale internal data to a later request. Either route can lead to commands being executed on the server.
The exposure applies to websites served through several common PHP configurations:
- PHP-FPM
- Apache with mod_php
- php-cgi
- FrankenPHP
- LiteSpeed
mod_php deployments are considered especially risky because the demonstrated attack can be triggered before the application itself begins running. In practical terms, a WordPress security plug-in or an in-app web application firewall may not have an opportunity to block the request. Upload restrictions, disabling session.upload_progress, and filtering unusually large requests may reduce some attack paths, but they do not make an unpatched server safe and can affect site behavior.
What WordPress and managed-hosting customers should do
WordPress core, theme, and plug-in updates remain important, but they do not update PHP. In WordPress, the runtime actually serving the site can be checked under Tools → Site Health → Info → Server → PHP version. This is more useful than relying solely on the version selected in a hosting dashboard, since a server can have multiple PHP builds installed while a site remains attached to an older PHP-FPM pool.
- Verify the PHP version actively used by the site, rather than only the versions available in the control panel.
- Ask the hosting provider whether CVE-2026-109618 and CVE-2026-109619 have been remediated.
- Confirm whether selecting the patched PHP build requires a manual change for the site.
- Create a complete backup before changing PHP versions.
- Test forms, uploads, checkout flows, and the administrator dashboard after the update.
Administrators of VPS or dedicated servers should update PHP packages from their operating system’s repository and restart the relevant PHP-FPM, Apache, or LiteSpeed services. The php -v command checks the command-line installation, which may not be the same runtime serving a website, so the web-facing application should be checked separately.
If patching cannot happen immediately, CERT-EU recommends isolating the application from the internet or taking it offline temporarily. After applying a fix, administrators should review logs, recently changed files, newly created administrative accounts, and unfamiliar processes. Updating PHP alone does not remove malicious code that may already be present on a compromised server.
A shrinking window after disclosure
The first issue was reported following research by Calif and OpenAI using GPT-5.6 Sol. Wiz independently identified the vulnerabilities with its Atlas system and other AI models. The vulnerable code had existed for years, while demonstrating a complete exploitation chain had been difficult through manual research alone.
Once patches are public, automated tools can also compare code changes and help attackers develop exploits more quickly. That makes prompt verification especially important for mobile-focused businesses, schools, and small organizations whose sites handle account logins, forms, uploads, or online orders. The question for a host is not whether it offers PHP 8.3, but whether the site is running PHP 8.3.36 or a package explicitly confirmed to fix both CVEs.
Post Footer automatically generated by Add Post Footer Plugin for wordpress.
