Attackers are already probing the PHP flaws we covered two days ago. So far, Wordfence reports no confirmed break-ins from them.

What Wordfence is seeing

The PHP project released emergency updates on October 21 for CVE-2026-109618 and CVE-2026-109619. Wordfence says its firewall has blocked over 74,000 exploit or probing attempts tied to these flaws. That count also includes related attacks on the same PHP upload-handling feature.

Wordfence says it has seen no confirmed compromises. It takes that as a sign the exploit is complex to pull off. It protects more than 5 million WordPress sites.

One large attack group sends specially built upload requests. They try to run commands that read the .env and wp-config.php files. Those files hold database passwords and secret keys.

What to do

The fix has not changed. Install one of these PHP versions, or a vendor package your host confirms has both fixes:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

Then restart every PHP worker. These are the background processes that run your site’s code. An update that is installed but not restarted may not protect you.

Updating WordPress does not update PHP. Check your version under Tools > Site Health > Info > Server, or ask your host to confirm both the update and the restart.

End of article