The PHP project has released a security update for two critical flaws. Every WordPress site runs on PHP, so this affects you. WordPress.org is urging site owners to update PHP immediately.
What happened
PHP is the programming language that runs WordPress on your server. The flaws are in PHP itself, not in WordPress, a plugin, or a theme.
According to Wordfence, the two flaws are CVE-2026-109618 and CVE-2026-109619. They can allow unauthenticated remote code execution. That means an attacker could run their own code on your server without logging in first.
The PHP security team rated both flaws 9.2 on the CVSS v4.0 scale. That is in the Critical range.
Who is affected
Wordfence says all PHP installations serving web requests are at risk. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The PHP project considers the risk highest for mod_php. It has a demonstrated exploit where one unauthenticated request can trigger the attack before any application code runs.
Fixed versions
Update to the version that matches your PHP branch:
- PHP 8.5: 8.5.12
- PHP 8.4: 8.4.27
- PHP 8.3: 8.3.36
- PHP 8.2: 8.2.35
PHP versions before 8.2 no longer get security updates from the PHP project. WordPress.org says that if you run your own server on one of those versions, you should consider taking it offline while you move to a newer version. It points to similar advice from the UK National Cyber Security Centre.
What to do
No WordPress update is required or planned. WordPress automatic updates will not fix this. PHP has to be updated on the server.
- Check your PHP version in WordPress under Tools > Site Health > Info > Server. Your host’s control panel often shows it too.
- Ask your host whether it has installed the patched version. Many hosts are already updating PHP and adding firewall rules to block attacks.
- If your host lets you pick the PHP version, choose a supported, patched one.
- If you manage your own server, update PHP yourself as soon as you can.
End of article